how secure? (file upload script)

[traq]

I have a question:
I'm working on a script to upload files to a site.
How secure would you consider this to be, both in terms of the file type (in this case, jpg, gif, and png images only) and of user permission (the password)?


<?php
session_start();
if(!isset($_POST['upload'])) {
echo '
<form name="upload" enctype="multipart/form-data" method="POST" action="'.$_SERVER['REQUEST_URI'].'">
File to Upload: <input type="file" name="file" size="13" value="">
Enter Password: <input type="password" name="pass">
<input type="submit" name="upload" value="Upload">
</form>
';
} else {
$pass = $_POST['pass'];
if ($pass == "secret") {
$ok = array('image/gif', 'image/jpeg', 'image/jpg', 'image/png');
$typeok = false;
foreach($ok as $type){
if ($type == $_FILES['file']['type']){
$typeok = true;
break;
}
}
if ($typeok) {
$uploadpath = 'uploads/';
$filename = $_FILES['file']['name'];
$filesize = $_FILES['file']['size'];
$tmpname_file = $_FILES['file']['tmp_name'];
if($filesize > '5000000') {
echo "File is too large";
} else {
if(move_uploaded_file($tmpname_file, "$uploadpath$filename")) {
echo "Successful upload to: ".$uploadpath.$filename."<br>
<img src=\"".$uploadpath.$filename."\">";
} else {
echo "Upload Failed";
}
}
}
} else {
echo "Incorrect Password";
}
}
?>

[forum_amnesiac]

Depends on the number of people who will use it, if you have many people and one password then the risk of password 'leakage' is higher.

I prefer to have a password table in which I keep name and password.

This way everybody can have a unique password and you can create a password protected function to regularly update the passwords.

If it is for a single user, then I think it is reasonably secure

[traq]

yes, it's just for a single user.
(Actually, it's just an experiment. Next, I'm working on pulling user/password combinations from a database. With this script -with the password actually in the script- I've already found a way to get it; by storing the password in a database I think it'll be harder.)
Is the mime/type check fairly certain? How possible would it be to bypass and upload a file I didn't want?