Security flaw in this code approach
- by Alec Smart
Hello,
Am wondering if there would be any security flaw in this approach. I am writing a piece of code which allows users to upload files and another set to download those files. These files can be anything.
User uploads the file (any file including .php files), it is renamed to an md5 hash (extension removed) and stored on server. A corresponding mySQL entry is made.
The user trying to download the file, uses say download.php to download the file where the md5 file is sent (with the original name).
Is there someway in which anyone can exploit the above scenario?