moose-en-a-gant Posted February 3, 2015 Share Posted February 3, 2015 I'm talking like /uploads at the main folder where index.php or index.html goes These photos theoretically are meant to be publicly viewed anyway so what is bad about that? Let's say profile pictures. I mean couldn't anyone scrape facebook and "steal" profile pictures? I don't know why but I'm just wondering. Quote Link to comment https://forums.phpfreaks.com/topic/294343-is-it-bad-for-a-photos-folder-to-be-publicly-accessible/ Share on other sites More sharing options...
requinix Posted February 3, 2015 Share Posted February 3, 2015 (edited) The directory shouldn't be indexed (as in going to /uploads doesn't show a directory listing) but otherwise sure. But make sure you've validated uploads very, very well. A safer course would be to keep the directory private, such as by locating it outside the web root, and use a script to pass-through the information. The advantage there is that the web server plays no part in interpreting the file and your script would force everything to "be" an image - even if someone got past your validation and uploaded something different. Edited February 3, 2015 by requinix Quote Link to comment https://forums.phpfreaks.com/topic/294343-is-it-bad-for-a-photos-folder-to-be-publicly-accessible/#findComment-1504746 Share on other sites More sharing options...
moose-en-a-gant Posted February 3, 2015 Author Share Posted February 3, 2015 The directory shouldn't be indexed (as in going to /uploads doesn't show a directory listing) but otherwise sure. But make sure you've validated uploads very, very well. A safer course would be to keep the directory private, such as by locating it outside the web root, and use a script to pass-though the information. The advantage there is that the web server plays no part in interpreting the file and your script would force everything to "be" an image - even if someone got past your validation and uploaded something different. Yet another can of worms has been opened haha. Great suggestion / advice, I'll need to look into this. Quote Link to comment https://forums.phpfreaks.com/topic/294343-is-it-bad-for-a-photos-folder-to-be-publicly-accessible/#findComment-1504752 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.