3 ms·
It's possible that you've still missed something, unless you're certain that .php is the only extension which your server executes (.php5 often works, and some
by pwmanagerdied 17y ago
It's possible that you've still missed something, unless you're certain that .php is the only extension which your server executes (.php5 often works, and some servers will also run files with .cgi or .py extensions, among others). Blacklists are never fun.
The solution which occurs to me is (assuming you're on Apache) setting the .htaccess file in that directory to cause all files to be downloaded, regardless of their type. I haven't tested it, but I think this is the setting you'd need to make:
ForceType application/octet-stream
- jacquesm 17y agoyou had me paraonoid enough there to check :) It's ok though, the fix I applied was a little more elaborate than indicated above. thanks anyway!
- TimothyFitz 17y agoIt's really hard to harden yourself against code getting interpreted by the browser (and thus allowing someone to steal cookies and impersonate other users). Here's a long article on exactly how complex it is (as known today): http://tstarling.com/blog/2008/12/secure-web-uploads/ http://tstarling.com/blog/2008/12/secure-web-uploads/ Personally, I just don't trust web uploads on the same domain. Put them on a subdomain or better yet a completely separate domain, preferably served out of something set up to never execute any code whatsoever.
- jacquesm 17y agoExcellent read Timothy, thank you. I have changed some of the code because of this article. I also checked the history of all uploads to see if any of the holes mentioned had been used, and apparently there was at least one instance of somebody trying the .js route but they got hung up on the fact that the file names are changed after every download.
- duskwuff 17y agoBy default, mod_php registers .php, .php4, .php5, .phtml, and .pht. (Also .phps, but that isn't executed.) A lot of people forget about the last two.