block application/x-www-form-urlencoded

1 files changed, 8 insertions, 1 deletions

diff --git a/upload.php b/upload.php
index 991cde7..352fdf8 100644
--- a/upload.php
+++ b/upload.php
@@ -13,7 +13,14 @@ if ($_SERVER['REQUEST_METHOD'] != 'POST' && $_SERVER['REQUEST_METHOD'] != 'PUT')
 }
 
 $c_t = strtolower($_SERVER['HTTP_CONTENT_TYPE'] ?? '');
-if ($c_t == 'multipart/form-data' || 0 === strpos($c_t, 'multipart/form-data;')) {
+if ($c_t == 'application/x-www-form-urlencoded') {
+	header('Status: 415 Unsupported Media Type');
+	header('Content-Type: text/plain');
+	echo "You seem like a really dumb bot that doesn't check the enctype of the form before spraying common vulnerabilities.\n";
+	echo "Content-Type: application/x-www-form-urlencoded is not supported.\n";
+	send_notification("[hostfil.es] $_SERVER[REMOTE_ADDR] tried to $_SERVER[REQUEST_METHOD] $c_t");
+	exit;
+} elseif ($c_t == 'multipart/form-data' || 0 === strpos($c_t, 'multipart/form-data;')) {
 	$FILES = remap_files();
 	if (!isset($FILES['file'])) {
 		die_error("You need to upload the file within the field name 'file[]' (or 'file' if there's only one) if you want to use multipart/form-data.", '406 Not Acceptable');