Unrestricted File Upload in PHP Applications

# SECURE: Hardened Apache configuration
<VirtualHost *:80>
    DocumentRoot /var/www/html
    
    # Secure upload directory configuration
    <Directory "/var/www/html/uploads">
        # Disable script execution completely
        Options -Indexes -ExecCGI
        AllowOverride None
        Require all granted
        
        # Remove all script handlers
        RemoveHandler .php .phtml .php3 .php4 .php5 .pl .py .jsp .asp .sh .cgi
        
        # Prevent execution of common script extensions
        <FilesMatch "\.(php|php3|php4|php5|phtml|pl|py|jsp|asp|sh|cgi)$">
            Order Allow,Deny
            Deny from all
        </FilesMatch>
        
        # Force download for all files
        <FilesMatch ".*">
            Header set Content-Disposition "attachment"
            Header set X-Content-Type-Options "nosniff"
        </FilesMatch>
    </Directory>
    
    # Global security headers
    Header always set X-Content-Type-Options nosniff
    Header always set X-Frame-Options DENY
    Header always set Content-Security-Policy "default-src 'self'"
    
    # File upload limits
    LimitRequestBody 5242880  # 5MB limit
</VirtualHost>

# Additional security in main config
# Disable dangerous functions in php.ini:
# disable_functions = exec,passthru,shell_exec,system,proc_open,popen
# file_uploads = On
# upload_max_filesize = 5M
# post_max_size = 5M
# max_file_uploads = 5

// SECURE: Enhanced client-side validation with server-side verification
class SecureFileUpload {
    constructor() {
        this.allowedTypes = ['image/jpeg', 'image/png', 'image/gif', 'application/pdf'];
        this.maxSize = 5 * 1024 * 1024; // 5MB
        this.setupEventListeners();
    }
    
    setupEventListeners() {
        const fileInput = document.getElementById('fileUpload');
        fileInput.addEventListener('change', this.validateFile.bind(this));
        
        const form = document.getElementById('uploadForm');
        form.addEventListener('submit', this.handleSubmit.bind(this));
    }
    
    async validateFile(event) {
        const file = event.target.files[0];
        if (!file) return;
        
        // Client-side pre-validation for UX
        const errors = [];
        
        // Check file size
        if (file.size > this.maxSize) {
            errors.push(`File too large. Maximum size: ${this.maxSize / 1024 / 1024}MB`);
        }
        
        // Check MIME type
        if (!this.allowedTypes.includes(file.type)) {
            errors.push(`File type not allowed: ${file.type}`);
        }
        
        // Read file header for additional validation
        try {
            const isValid = await this.validateFileHeader(file);
            if (!isValid) {
                errors.push('Invalid file format detected');
            }
        } catch (e) {
            errors.push('File validation failed');
        }
        
        if (errors.length > 0) {
            this.showErrors(errors);
            event.target.value = ''; // Clear input
        } else {
            this.showSuccess('File validation passed');
        }
    }
    
    async validateFileHeader(file) {
        return new Promise((resolve) => {
            const reader = new FileReader();
            reader.onload = function(e) {
                const arr = new Uint8Array(e.target.result).subarray(0, 4);
                let header = '';
                for (let i = 0; i < arr.length; i++) {
                    header += arr[i].toString(16);
                }
                
                // Check magic bytes
                const validHeaders = {
                    'ffd8ff': 'image/jpeg',
                    '89504e47': 'image/png',
                    '47494638': 'image/gif',
                    '25504446': 'application/pdf'
                };
                
                const isValid = Object.keys(validHeaders).some(magic => 
                    header.startsWith(magic)
                );
                resolve(isValid);
            };
            reader.readAsArrayBuffer(file.slice(0, 4));
        });
    }
    
    async handleSubmit(event) {
        event.preventDefault();
        
        const formData = new FormData(event.target);
        const uploadButton = document.getElementById('uploadButton');
        
        uploadButton.disabled = true;
        uploadButton.textContent = 'Uploading...';
        
        try {
            const response = await fetch('/secure-upload.php', {
                method: 'POST',
                body: formData,
                headers: {
                    'X-Requested-With': 'XMLHttpRequest',
                    'X-CSRF-Token': document.querySelector('[name=csrf_token]').value
                }
            });
            
            const result = await response.json();
            
            if (result.success) {
                this.showSuccess(result.message);
                event.target.reset();
            } else {
                this.showErrors([result.message]);
            }
        } catch (error) {
            this.showErrors(['Upload failed: Network error']);
        } finally {
            uploadButton.disabled = false;
            uploadButton.textContent = 'Upload File';
        }
    }
    
    showErrors(errors) {
        const errorDiv = document.getElementById('errors');
        errorDiv.innerHTML = errors.map(error => `<p class="error">${error}</p>`).join('');
        errorDiv.style.display = 'block';
    }
    
    showSuccess(message) {
        const errorDiv = document.getElementById('errors');
        errorDiv.innerHTML = `<p class="success">${message}</p>`;
        errorDiv.style.display = 'block';
    }
}

// Initialize when DOM loads
document.addEventListener('DOMContentLoaded', () => {
    new SecureFileUpload();
});