Re: Protector protects from a legitimate upload.

List posts in the topic

Re: Protector protects from a legitimate upload.

msg# 1.7.1

depth:

2

Previous post - Next post | Parent - No child | Posted on 2007/9/6 4:03

GIJOE    Posts: 4110

Easy to answer.
Just store files with allowed extensions inside DocumentRoot.
And never allow multiple dots.

Blacklist will be non-sense.
Only Both checking by whitelist of extensions(.gif/.png/.jpg/.jpeg) and their contents are meaningful.

.xls, .doc, .pdf...
They should not be stored inside DocumentRoot.
Because there are no means to checking the contents.

If you want to put a php source file, use outside of DocumentRoot or make file name hash like pukiwiki.


XOOPS_TRUST_PATH must be useful such uploading situation.

XOOPS_TRUST_PATH/uploads/

Votes:1 Average:10.00

Posts tree

• Protector protects from a legitimate upload. (vaughan, 2007/8/27 0:46)
  • Re: Protector protects from a legitimate upload. (GIJOE, 2007/8/28 12:35)
  • Re: Protector protects from a legitimate upload. (vaughan, 2007/8/29 3:48)
    • Re: Protector protects from a legitimate upload. (GIJOE, 2007/8/29 5:51)
  • Re: Protector protects from a legitimate upload. (Dave_L, 2007/8/29 4:30)
    • Re: Protector protects from a legitimate upload. (GIJOE, 2007/8/29 5:32)
    • Re: Protector protects from a legitimate upload. (vaughan, 2007/8/29 8:44)
      • Re: Protector protects from a legitimate upload. (GIJOE, 2007/8/31 4:30)
  • Re: Protector protects from a legitimate upload. (suico, 2007/9/1 4:15)
  • Re: Protector protects from a legitimate upload. (Dave_L, 2007/9/4 17:59)
    • Re: Protector protects from a legitimate upload. (GIJOE, 2007/9/5 12:34)
  • Re: Protector protects from a legitimate upload. (suico, 2007/9/4 20:11)
  • Re: Protector protects from a legitimate upload. (suico, 2007/9/6 2:44)
    • Re: Protector protects from a legitimate upload. (GIJOE, 2007/9/6 4:03)
  • Re: Protector protects from a legitimate upload. (vaughan, 2007/9/21 3:41)
    • Re: Protector protects from a legitimate upload. (GIJOE, 2007/9/22 17:34)
  • Re: Protector protects from a legitimate upload. (vaughan, 2007/9/28 1:38)
    • Re: Protector protects from a legitimate upload. (GIJOE, 2007/9/28 3:09)