moose-en-a-gant Posted February 3, 2015 Share Posted February 3, 2015 I'm talking like /uploads at the main folder where index.php or index.html goes These photos theoretically are meant to be publicly viewed anyway so what is bad about that? Let's say profile pictures. I mean couldn't anyone scrape facebook and "steal" profile pictures? I don't know why but I'm just wondering. Link to comment https://forums.phpfreaks.com/topic/294343-is-it-bad-for-a-photos-folder-to-be-publicly-accessible/ Share on other sites More sharing options...
requinix Posted February 3, 2015 Share Posted February 3, 2015 The directory shouldn't be indexed (as in going to /uploads doesn't show a directory listing) but otherwise sure. But make sure you've validated uploads very, very well. A safer course would be to keep the directory private, such as by locating it outside the web root, and use a script to pass-through the information. The advantage there is that the web server plays no part in interpreting the file and your script would force everything to "be" an image - even if someone got past your validation and uploaded something different. Link to comment https://forums.phpfreaks.com/topic/294343-is-it-bad-for-a-photos-folder-to-be-publicly-accessible/#findComment-1504746 Share on other sites More sharing options...
moose-en-a-gant Posted February 3, 2015 Author Share Posted February 3, 2015 The directory shouldn't be indexed (as in going to /uploads doesn't show a directory listing) but otherwise sure. But make sure you've validated uploads very, very well. A safer course would be to keep the directory private, such as by locating it outside the web root, and use a script to pass-though the information. The advantage there is that the web server plays no part in interpreting the file and your script would force everything to "be" an image - even if someone got past your validation and uploaded something different. Yet another can of worms has been opened haha. Great suggestion / advice, I'll need to look into this. Link to comment https://forums.phpfreaks.com/topic/294343-is-it-bad-for-a-photos-folder-to-be-publicly-accessible/#findComment-1504752 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.