Una funció mime_types()
function mimeTypes()
{
/* Just add any required MIME type if you are going to download something not listed here.*/
$mime_types = array("323" => "text/h323",
"acx" => "application/internet-property-stream",
"ai" => "application/postscript",
"aif" => "audio/x-aiff",
"aifc" => "audio/x-aiff",
"aiff" => "audio/x-aiff",
"asf" => "video/x-ms-asf",
"asr" => "video/x-ms-asf",
"asx" => "video/x-ms-asf",
"au" => "audio/basic",
"avi" => "video/x-msvideo",
"axs" => "application/olescript",
"bas" => "text/plain",
"bcpio" => "application/x-bcpio",
"bin" => "application/octet-stream",
"bmp" => "image/bmp",
"c" => "text/plain",
"cat" => "application/vnd.ms-pkiseccat",
"cdf" => "application/x-cdf",
"cer" => "application/x-x509-ca-cert",
"class" => "application/octet-stream",
"clp" => "application/x-msclip",
"cmx" => "image/x-cmx",
"cod" => "image/cis-cod",
"cpio" => "application/x-cpio",
"crd" => "application/x-mscardfile",
"crl" => "application/pkix-crl",
"crt" => "application/x-x509-ca-cert",
"csh" => "application/x-csh",
"css" => "text/css",
"dcr" => "application/x-director",
"der" => "application/x-x509-ca-cert",
"dir" => "application/x-director",
"dll" => "application/x-msdownload",
"dms" => "application/octet-stream",
"doc" => "application/msword",
"dot" => "application/msword",
"dvi" => "application/x-dvi",
"dxr" => "application/x-director",
"eps" => "application/postscript",
"etx" => "text/x-setext",
"evy" => "application/envoy",
"exe" => "application/octet-stream",
"fif" => "application/fractals",
"flr" => "x-world/x-vrml",
"gif" => "image/gif",
"gtar" => "application/x-gtar",
"gz" => "application/x-gzip",
"h" => "text/plain",
"hdf" => "application/x-hdf",
"hlp" => "application/winhlp",
"hqx" => "application/mac-binhex40",
"hta" => "application/hta",
"htc" => "text/x-component",
"htm" => "text/html",
"html" => "text/html",
"htt" => "text/webviewhtml",
"ico" => "image/x-icon",
"ief" => "image/ief",
"iii" => "application/x-iphone",
"ins" => "application/x-internet-signup",
"isp" => "application/x-internet-signup",
"jfif" => "image/pipeg",
"jpe" => "image/jpeg",
"jpeg" => "image/jpeg",
"jpg" => "image/jpeg",
"js" => "application/x-javascript",
"latex" => "application/x-latex",
"lha" => "application/octet-stream",
"lsf" => "video/x-la-asf",
"lsx" => "video/x-la-asf",
"lzh" => "application/octet-stream",
"m13" => "application/x-msmediaview",
"m14" => "application/x-msmediaview",
"m3u" => "audio/x-mpegurl",
"man" => "application/x-troff-man",
"mdb" => "application/x-msaccess",
"me" => "application/x-troff-me",
"mht" => "message/rfc822",
"mhtml" => "message/rfc822",
"mid" => "audio/mid",
"mny" => "application/x-msmoney",
"mov" => "video/quicktime",
"movie" => "video/x-sgi-movie",
"mp2" => "video/mpeg",
"mp3" => "audio/mpeg",
"mpa" => "video/mpeg",
"mpe" => "video/mpeg",
"mpeg" => "video/mpeg",
"mpg" => "video/mpeg",
"mpp" => "application/vnd.ms-project",
"mpv2" => "video/mpeg",
"ms" => "application/x-troff-ms",
"mvb" => "application/x-msmediaview",
"nws" => "message/rfc822",
"oda" => "application/oda",
"p10" => "application/pkcs10",
"p12" => "application/x-pkcs12",
"p7b" => "application/x-pkcs7-certificates",
"p7c" => "application/x-pkcs7-mime",
"p7m" => "application/x-pkcs7-mime",
"p7r" => "application/x-pkcs7-certreqresp",
"p7s" => "application/x-pkcs7-signature",
"pbm" => "image/x-portable-bitmap",
"pdf" => "application/pdf",
"pfx" => "application/x-pkcs12",
"pgm" => "image/x-portable-graymap",
"pko" => "application/ynd.ms-pkipko",
"pma" => "application/x-perfmon",
"pmc" => "application/x-perfmon",
"pml" => "application/x-perfmon",
"pmr" => "application/x-perfmon",
"pmw" => "application/x-perfmon",
"pnm" => "image/x-portable-anymap",
"pot" => "application/vnd.ms-powerpoint",
"ppm" => "image/x-portable-pixmap",
"pps" => "application/vnd.ms-powerpoint",
"ppt" => "application/vnd.ms-powerpoint",
"prf" => "application/pics-rules",
"ps" => "application/postscript",
"pub" => "application/x-mspublisher",
"qt" => "video/quicktime",
"ra" => "audio/x-pn-realaudio",
"ram" => "audio/x-pn-realaudio",
"ras" => "image/x-cmu-raster",
"rgb" => "image/x-rgb",
"rmi" => "audio/mid",
"roff" => "application/x-troff",
"rtf" => "application/rtf",
"rtx" => "text/richtext",
"scd" => "application/x-msschedule",
"sct" => "text/scriptlet",
"setpay" => "application/set-payment-initiation",
"setreg" => "application/set-registration-initiation",
"sh" => "application/x-sh",
"shar" => "application/x-shar",
"sit" => "application/x-stuffit",
"snd" => "audio/basic",
"spc" => "application/x-pkcs7-certificates",
"spl" => "application/futuresplash",
"src" => "application/x-wais-source",
"sst" => "application/vnd.ms-pkicertstore",
"stl" => "application/vnd.ms-pkistl",
"stm" => "text/html",
"svg" => "image/svg+xml",
"sv4cpio" => "application/x-sv4cpio",
"sv4crc" => "application/x-sv4crc",
"t" => "application/x-troff",
"tar" => "application/x-tar",
"tcl" => "application/x-tcl",
"tex" => "application/x-tex",
"texi" => "application/x-texinfo",
"texinfo" => "application/x-texinfo",
"tgz" => "application/x-compressed",
"tif" => "image/tiff",
"tiff" => "image/tiff",
"tr" => "application/x-troff",
"trm" => "application/x-msterminal",
"tsv" => "text/tab-separated-values",
"txt" => "text/plain",
"uls" => "text/iuls",
"ustar" => "application/x-ustar",
"vcf" => "text/x-vcard",
"vrml" => "x-world/x-vrml",
"wav" => "audio/x-wav",
"wcm" => "application/vnd.ms-works",
"wdb" => "application/vnd.ms-works",
"wks" => "application/vnd.ms-works",
"wmf" => "application/x-msmetafile",
"wps" => "application/vnd.ms-works",
"wri" => "application/x-mswrite",
"wrl" => "x-world/x-vrml",
"wrz" => "x-world/x-vrml",
"xaf" => "x-world/x-vrml",
"xbm" => "image/x-xbitmap",
"xla" => "application/vnd.ms-excel",
"xlc" => "application/vnd.ms-excel",
"xlm" => "application/vnd.ms-excel",
"xls" => "application/vnd.ms-excel",
"xlt" => "application/vnd.ms-excel",
"xlw" => "application/vnd.ms-excel",
"xof" => "x-world/x-vrml",
"xpm" => "image/x-xpixmap",
"xwd" => "image/x-xwindowdump",
"z" => "application/x-compress",
"rar" => "application/x-rar-compressed",
"zip" => "application/zip");
return $mime_types;
} La funció mimeTypes() és una implementació clàssica de PHP que crea un mapatge d'extensions d'arxiu a MIME Types . Aquest tipus de funció és habitualment utilitzada en scripts de servidors (especialment per a la descàrrega) que necessiten assignar el tipus de contingut correcte basant-se únicament en l'extensió del nom de fitxer.
Que fa la funció mimeTypes()?
La funció mimeTypes() simplement retorna un array associatiu on:
-
La clau és l'extensió del fitxer (p. ex.,
"jpg","pdf","doc"). -
El valor és la cadena de text corresponent al MIME Type (p. ex.,
"image/jpeg","application/pdf","application/msword").
Aquesta funció és dissenyada per ser utilitzada pel servidor quan ha de servir o forçar la descàrrega d'un fitxer al client (navegador). Abans d'enviar el contingut del fitxer, el servidor necessita establir la capçalera Content-Type.
L'estructura d'ús típic seria:
-
Obtenir l'extensió: Extreure l'extensió del fitxer que es vol servir (p. ex.,
document.pdf->pdf). -
Buscar el MIME Type: Utilitzar aquesta extensió com a clau per buscar el valor a l'array retornat per
mimeTypes(). -
Establir la Capçalera: Utilitzar el MIME Type resultant a la capçalera HTTP.
function serveix_fitxer($nom_fitxer) {
$mimes = mimeTypes();
$ext = pathinfo($nom_fitxer, PATHINFO_EXTENSION); // 'pdf'
if (isset($mimes[$ext])) {
$mime_type = $mimes[$ext]; // 'application/pdf'
// El servidor indica al navegador què s'està enviant
header("Content-Type: $mime_type");
// ... Codi per enviar el fitxer (readfile())
}
}Detalls i consideracions de seguretat
Tot i ser funcional, aquest mètode té limitacions significatives que qualsevol desenvolupador web ha de conèixer:
1. Inseguretat en la validació d'Uploads
Aquesta funció NO HA DE SER UTILITZADA MAI per validar fitxers durant un procés d'upload (càrrega).
-
Motiu: Es basa únicament en l'extensió del nom de fitxer, la qual és fàcilment manipulable per un usuari maliciós. Un atacant podria pujar un fitxer que conté codi PHP maliciós i anomenar-lo
"virus.jpg". Aquesta funció el classificaria com a"image/jpeg", però si el servidor l'executa, es causaria un desastre. -
Alternativa Segura: Com es detalla en anteriors apartats, per a la validació d'uploads, s'han d'utilitzar funcions que llegeixen el contingut real del fitxer temporal, com
mime_content_type()ogetimagesize().
2. Dependència del Nomenclàtor
El MIME Type assignat depèn totalment de la precisió de la llista i de la correcta extensió del fitxer.
-
Si un fitxer té una extensió no llistada (p. ex.,
.webp), l'script fallarà o podria utilitzar un MIME Type genèric (application/octet-stream). -
A més, alguns fitxers (com els de Microsoft Office moderns:
.docx,.xlsx) utilitzen MIME Types més específics (application/vnd.openxmlformats-officedocument...) que poden no estar en aquesta llista, ja que està orientada a formats més antics o generalistes (p. ex.,.docutilitza"application/msword").
3. Alternativa Nativa del Servidor
En molts entorns de servidors professionals, aquesta tasca de mapatge d'extensió a MIME Type no cal fer-la amb PHP. El propi servidor web (Apache, Nginx) ja té bases de dades internes (com el fitxer mime.types o configuracions de Nginx) que gestionen aquesta tasca de manera més eficient.
La funció mimeTypes() és útil en situacions molt concretes on PHP ha d'actuar com a intermediari per forçar la descàrrega de continguts, però s'ha d'evitar com a mètode de seguretat o validació de fitxers entrants.