Is keeping uploads folder outside of 'public_html' enough to keep my application secure from malicio

Posted by ecu on Stack Overflow See other posts from Stack Overflow or by ecu
Published on 2010-06-03T11:08:40Z Indexed on 2010/06/03 11:14 UTC
Read the original article Hit count: 145

Filed under:

php

|

upload

Although I realise there are different approaches to securing upload process, I'm still confused when it comes to basic principles. I want to allow users to upload any kind of file they want, but keep my app secure. So my question is:

Is it sufficient to store the files with their original names in 'uploads' folder outside 'webroot' and fetching them via some download.php script?

If it't not secure enough, please point me in the right direction, or suggest what additional steps I should take to make it safe. Thank you.

© Stack Overflow or respective owner

Related posts about php

Magento, NGINX, PHP-FPM, APC, MEMCACHED, 16gb Ram CentOS, Spiking PHP-FPM to 100% CPU

as seen on Server Fault - Search for 'Server Fault'
I have been trying to resolve my issue of spiking cpu caused by php-fpm processes. I've reduced the php-fpm config settings to: pm = ondemand pm.max_children = 12 pm.start_servers = 2 pm.min_spare_servers = 2 pm.max_spare_servers = 10 pm.max_requests = 500 php_admin_value[memory_limit] = 128M Problem… >>> More
PHP Pear Installation on CentOS

as seen on Server Fault - Search for 'Server Fault'
[root@ip ~]# yum install php-pear* Reducing CentOS-5 Testing to included packages only Finished Setting up Install Process Package 1:php-pear-1.8.1-2.el5.centos.noarch already installed and latest versio … >>> More
Apache configurations for php "AddType text/html php" or "AddType application/x-httpd-php php .php"

as seen on Server Fault - Search for 'Server Fault'
I am taking over an application server and discover that it contain the following settings: AddType text/html php Although it works, but my understanding is that it should set as following: AddType application/x-httpd-php php .php What are the key differences between the two settings?… >>> More
mod_rewrite settings causes server to throw HTTP 500 errors instead of 404

as seen on Server Fault - Search for 'Server Fault'
Hello. I have a server with VBulletin forum (working under Apache 2.2, CentOS). The default settings for it in .htaccess are as follows: RewriteEngine on RewriteCond %{HTTP_HOST} ^gsmforum\.ru RewriteRule (.*) http://www.gsmforum.ru/$1 [R=301,L] # If you are having problems or are using VirtualDocumentRoot… >>> More
Problems installing Memcache (PECL extension)

as seen on Server Fault - Search for 'Server Fault'
I have installed memcached fine, and now I will need to install PECL extension memcache. Im running RedHat x86_64 es5. The installation gives me this: downloading memcache-2.2.6.tgz ... Starting to download memcache-2.2.6.tgz (35,957 bytes) ..........done: 35,957 bytes 11 source files, building running:… >>> More

Related posts about upload

PHP File Upload second file does not upload, first file does without error

as seen on Stack Overflow - Search for 'Stack Overflow'
So I have a script I have been using and it generally works well with multiple files... When I upload a very large file in a multiple file upload, only the first file is uploaded. I am not seeing an errors as to why. I figure this is related to a timeout setting but can not figure it out - Any… >>> More
Upload multiple Images and Ping an address to upload them

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello! I am trying to allow administrators to upload 20-30 images in one go. I have tried jquery uploadify, SWFUpload and other various jquery scripts. However I have had many issues doing this. Uploadify worked fine, however it stopped working and after a day of debugging I couldn't figure out… >>> More
Upload an image using class.upload.php via AJAX, display image in form using jQuery

as seen on Stack Overflow - Search for 'Stack Overflow'
I am using class.upload.php to handle an image upload from a form that submits employee details to a MySQL database. class.upload.php does EXACTLY what I want it to do, resize the image and rename it - what I am now trying to accomplish is to upload via Ajax after the user selects the file and then… >>> More
Upload File to Windows Azure Blob in Chunks through ASP.NET MVC, JavaScript and HTML5

as seen on Geeks with Blogs - Search for 'Geeks with Blogs'
Originally posted on: http://geekswithblogs.net/shaunxu/archive/2013/07/01/upload-file-to-windows-azure-blob-in-chunks-through-asp.net.aspxMany people are using Windows Azure Blob Storage to store their data in the cloud. Blob storage provides 99.9% availability with easy-to-use API through .NET SDK… >>> More
javascript replace text with images problem

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm extremely new to JS and have this code that I'm trying to tweak. WHen I was adding the array, I had tested it with only a couple of items and it was working fine, now it just doesn't work, and I can't figure out what is wrong with it!! Basically, I'm trying to change every instance of a card… >>> More