CSV上传无效

Question

I have a web app that allows users to upload CSVs. I've tested it on the most recent version of Chrome (as well as other browsers) and it works fine. However, it doesn't work for my colleague who's using the exact same version of Chrome and uploading the exact same CSV. The only apparent difference is that he's on Windows and I'm on OS X, so I'm wondering if that could explain the difference. I don't have access to his browser, so I can't see what response he's returning.

Here's the site: dailyspiro.com/WF.php

HTML Excerpt:

<script type="text/javascript">
        function stopUpload(success){
              console.log(success);
              var csv1 = success['csv1'];
              var csv2 = success['csv2'];
              var csv3 = success['csv3'];
              var csv4 = success['csv4'];
              var csvError = success['error'];
              var id = success['id'];
              $('.js-wf-error').text(csvError);
              if (!csvError) {
                runWF(id, csv1, csv2, csv3, csv4);
              }
        }
</script>

<iframe id="upload_target" name="upload_target" src="#" style="width:0;height:0;border:0px solid

<form id="wf-form" class="js-wf-form" method="post" action="wf/csv-upload.php" enctype="multipart/form-data" target="upload_target">
    <input type="file" name="csv1" value="" class="text ui-widget-content ui-corner-all csv-upload" />
    <input type="file" name="csv2" value="" class="text ui-widget-content ui-corner-all csv-upload" />
    <input type="file" name="csv3" value="" class="text ui-widget-content ui-corner-all csv-upload" />
    <input type="file" name="csv4" value="" class="text ui-widget-content ui-corner-all csv-upload" />
  <a  href="#" onclick="$('.js-progress-bar').show(); $(this).closest('form').submit(); return false;" type="submit"class="button redButton largeButton run-wf-button">Run Walking Farm</a>
</form>

Full PHP upload file:

<?php

function generateID() {
    return substr(md5(uniqid(mt_rand(), true)), 0, 6);
}

function uploadFile($csv, $id, $i) {
    //$err = $_FILES[$csv]["error"];
    //echo $err;
    if($_FILES[$csv]["type"] != 'text/csv') {
        $error = 'file number ' . $i . ' is not a valid file type.';
        $path = '';
    }
    else {
        $error = '';
      $path = 'files/csv/' . $id . $i . '.csv';
        move_uploaded_file($_FILES[$csv]['tmp_name'], $path);
    }
    $output = array($path, $error);
    return $output;
}

$id = generateID();
$returnData = array();
$returnData['id'] = $id;
$returnData['error'] = '';


$i = 1;
while ($i <= 4) {
    $csv = 'csv' . $i;
    if(!file_exists($_FILES['csv' . $i]['tmp_name'])) {
        $returnData[$csv] = '';
    }
    else {
        $status = uploadFile($csv, $id, $i);
        if ($status[1] != '') {
            $returnData['error'] = $status[1];
        }
        else {
            $returnData[$csv] = $status[0];
        }
    }
    $i++;
}

print_r($returnData);

?>
<script language="javascript" type="text/javascript">
    window.top.window.stopUpload(<?php print json_encode($returnData); ?>);
</script>   

Answer 1

You can not rely on $_FILES[$csv]["type"] to be text/csv. There are many MIME types for csv, so validating against one is not a good idea. These are all the MIME types of CSV that I have encountered so far for my upload. I put this in an array.

$types = array(

    'text/csv',
    'text/plain',
    'application/csv',
    'text/comma-separated-values',
    'application/excel',
    'application/vnd.ms-excel',
    'application/vnd.msexcel',
    'text/anytext',
    'application/octet-stream',
    'application/txt');

How I checked it :

$info = pathinfo($_FILES['filename']['tmp_name']);

if(in_array(trim($_FILES['filename']['type']), $types) || ($info['extension'] == 'csv')