« first day (5206 days earlier)   

05:10
Ok thanks @AllenJB @hakre
 
6 hours later…
11:16
@hakre Just curious—since in Laravel every request is served through the index.php file as the starting point of the framework, if a .jpg or another file contains PHP code, will it be executable?
 
2 hours later…
13:46
@Asif Hmm, actually it depends on the web server configuration which request is served through Laravel's index.php entry script. Only those delegated there are. You can find that in your webservers' configuration.
However, if the requests for binary resources are wired through a php script, I don't know if Laravel's routing would handle them from top of my head. And with handle it must not mean they are getting evaluated by PHP, Laravel may have just some functionality to serve them.
Better configure your webserver to not pass such requests into the PHP process manager if you are using FPM.
It is also important in this context of file uploads, that you never use the filename as given by the uploader. This does not only include the suffix/extension but the whole name.
For the uploads you find this documented for Laravel here: laravel.com/docs/11.x/filesystem#file-uploads -- this is what they use the unique ID for.
If you override the filename, then I'd suggest not to rely on the filename normalization that ships with the library but construct filenames from 3.265 Portable Filename Character Set (opengroup.org).
 
2 hours later…
Wes
Wes
15:55
I just replied to a SO question after like... 10 years? Hello everyone xD
Ah no looks like I had some activity in 2022. Damnit
Someone already downvoted it
Typical SO
Literally they haven't even read it because I just posted it
16:15
Still trying to post questions on SO in the current year? Big mistake
Wes
Wes
brogramming is dead
internet is dying
 
1 hour later…
17:38
All of that moving fast and breaking stuff...
I'm starting to experience the difficulty of searching for stuff through search engines that I've heard others complain about
Search engines just giving unrelated results, inaccurate results or zero results
@Asif I defer to hakre and AllenJB because they're generally more knowledgeable about stuff. With that said, I want to suggest also checking MIME type of the file, because it's possible for someone to give a file extension as jpg, but it not actually be a jpg file.
If you're on Linux, easy way to check is fileinfo <filename> if you have the file readily available, and having the file stored locally won't be a security risk...
18:18
@Tiffany search engines are dead. we go back to searching bookmark collections and pass links around.
Wes
Wes
18:39
chatgpt's been more useful than google lately
google is no more. all i get is amazon affiliate links
we need web 3.0. no jabba script, static pages, easily indexable, semantic tags, like we were doing before people started to go nuts about js heavy web pages
indexing js content is practically impossible
 
4 hours later…
23:06
@Wes chatgpt becoming more useful because all of the llm-churn :(

« first day (5206 days earlier)