Securing file upload / uploaded files folder on server

Quote from: dubbs at Oct 09, 2015, 10:37 AM

Bob - does your FileUpload addon ensure security when users upload files? Or is it just best to avoid file uploading for fear of hackers uploading malicious scripts/files to attack the server etc?

I don't actually use FileUpload because I have no need for it right now (and most of the code comes from the Evo version which I didn't write). That said, IIRC FileUpload uploads the files to a temporary directory, then moves them wherever you want, so users will have rights to upload to the temp directory, but don't have to have access to the files, which are removed from the temp directory, and shouldn't be able to execute them.

As long as you have users register, verify them by emailing a login link, require them to log in before uploading anything, restrict the file extensions to non-executable file types, and keep the files in a directory that's read-only for outsiders, I think it's fairly safe.

Thanks MrHaw - tried http://modx.com/extras/package/dropboxuploader but snippet code is too old for current day Dropbox user authentication so is useless... Will have a look into the package you suggest - if you could send over some code examples that would be ace- I need to be able to upload a file, and then store in the modUser fields - the url to the file on the dropbox server, and then update the file once the first version is uploaded - e.g. upload another to replace the first one at a later date.

I have it working nicely as a media source now - just need to work out how to upload files directly to it from the front-end website and then store the filename / location in modUser Extended field... Appreciate any thoughts!

Cheers


dubbs [ed. note: dubbs last edited this post 10 years, 11 months ago.]

Quote from: BobRay at Oct 12, 2015, 11:28 AM

Quote from: dubbs at Oct 09, 2015, 10:37 AM

Bob - does your FileUpload addon ensure security when users upload files? Or is it just best to avoid file uploading for fear of hackers uploading malicious scripts/files to attack the server etc?

I don't actually use FileUpload because I have no need for it right now (and most of the code comes from the Evo version which I didn't write). That said, IIRC FileUpload uploads the files to a temporary directory, then moves them wherever you want, so users will have rights to upload to the temp directory, but don't have to have access to the files, which are removed from the temp directory, and shouldn't be able to execute them.

As long as you have users register, verify them by emailing a login link, require them to log in before uploading anything, restrict the file extensions to non-executable file types, and keep the files in a directory that's read-only for outsiders, I think it's fairly safe.

Thanks Bob - appreciate your thoughts. I was not sure that FileUploader did move the file to a new location? Maybe it does...? I need to allow none registered users to upload - e.g. its part of their registration... I could move it to a 2nd phase part of the registration I guess so making it more secure. I like the dropbox approach though as it keeps any dodgy uploaded files away from the website! Thoughts?

Quote from: dubbs at Oct 12, 2015, 11:35 AM

Thanks MrHaw - tried http://modx.com/extras/package/dropboxuploader but snippet code is too old for current day Dropbox user authentication so is useless... Will have a look into the package you suggest - if you could send over some code examples that would be ace- I need to be able to upload a file, and then store in the modUser fields - the url to the file on the dropbox server, and then update the file once the first version is uploaded - e.g. upload another to replace the first one at a later date.

I have it working nicely as a media source now - just need to work out how to upload files directly to it from the front-end website and then store the filename / location in modUser Extended field... Appreciate any thoughts!

Cheers


dubbs

Integrating Dropbox will require a lot of work and coding.
I only have code retrieving files for display. I never considered uploading from outside of the manager.
(I will try to remeber to share some of it when I get to my home computer)

Google translate
http://habrahabr.ru/post/245243/
http://modxclub.ru/topics/dropbox-2.1.2migxphpthumbof-1637.html
http://modxclub.ru/topics/migx-i-dropbox-2.1.2-beta-1630.html#comment-6203
http://habrahabr.ru/post/245243/

to see what is involved! [ed. note: mrhaw last edited this post 10 years, 11 months ago.]

Quote from: mrhaw at Oct 12, 2015, 01:10 PM

Quote from: dubbs at Oct 12, 2015, 11:35 AM

Thanks MrHaw - tried http://modx.com/extras/package/dropboxuploader but snippet code is too old for current day Dropbox user authentication so is useless... Will have a look into the package you suggest - if you could send over some code examples that would be ace- I need to be able to upload a file, and then store in the modUser fields - the url to the file on the dropbox server, and then update the file once the first version is uploaded - e.g. upload another to replace the first one at a later date.

I have it working nicely as a media source now - just need to work out how to upload files directly to it from the front-end website and then store the filename / location in modUser Extended field... Appreciate any thoughts!

Cheers


dubbs

Integrating Dropbox will require a lot of work and coding.
I only have code retrieving files for display. I never considered uploading from outside of the manager.
(I will try to remeber to share some of it when I get to my home computer)

Google translate
http://habrahabr.ru/post/245243/
http://modxclub.ru/topics/dropbox-2.1.2migxphpthumbof-1637.html
http://modxclub.ru/topics/migx-i-dropbox-2.1.2-beta-1630.html#comment-6203
http://habrahabr.ru/post/245243/

to see what is involved!

thanks I've been looking around myself... seems all the dropbox uploaders that were created 5 years ago... now all don't work... no-one seems to have created a new one that works with the current Auth system / API!????

Quote from: mrhaw at Oct 12, 2015, 01:10 PM

Quote from: dubbs at Oct 12, 2015, 11:35 AM

Thanks MrHaw - tried http://modx.com/extras/package/dropboxuploader but snippet code is too old for current day Dropbox user authentication so is useless... Will have a look into the package you suggest - if you could send over some code examples that would be ace- I need to be able to upload a file, and then store in the modUser fields - the url to the file on the dropbox server, and then update the file once the first version is uploaded - e.g. upload another to replace the first one at a later date.

I have it working nicely as a media source now - just need to work out how to upload files directly to it from the front-end website and then store the filename / location in modUser Extended field... Appreciate any thoughts!

Cheers


dubbs

Integrating Dropbox will require a lot of work and coding.
I only have code retrieving files for display. I never considered uploading from outside of the manager.
(I will try to remeber to share some of it when I get to my home computer)

Google translate
http://habrahabr.ru/post/245243/
http://modxclub.ru/topics/dropbox-2.1.2migxphpthumbof-1637.html
http://modxclub.ru/topics/migx-i-dropbox-2.1.2-beta-1630.html#comment-6203
http://habrahabr.ru/post/245243/

to see what is involved!

Had a quick look at the links and cant really see any clues on how the file upload process would work. It's also all unfortunately well above my PHP scripting abilities which is a shame. Does anyone know of a dropbox file upload facility from a website?

Quote from: dubbs at Oct 13, 2015, 03:39 AM

Had a quick look at the links and cant really see any clues on how the file upload process would work. It's also all unfortunately well above my PHP scripting abilities which is a shame. Does anyone know of a dropbox file upload facility from a website?

See this thread: https://www.dropboxforum.com/hc/en-us/community/posts/202523255-Is-there-a-Upload-widget-that-I-can-embed-on-my-site-

In order to upload files using MODX frontend I would study and break down the code that makes it happen within MODX backend.
Nikolay is very helpful. https://twitter.com/hawproductions/status/552341523921403906

Quote from: mrhaw at Oct 13, 2015, 10:20 AM

Quote from: dubbs at Oct 13, 2015, 03:39 AM

Had a quick look at the links and cant really see any clues on how the file upload process would work. It's also all unfortunately well above my PHP scripting abilities which is a shame. Does anyone know of a dropbox file upload facility from a website?

See this thread: https://www.dropboxforum.com/hc/en-us/community/posts/202523255-Is-there-a-Upload-widget-that-I-can-embed-on-my-site-

In order to upload files using MODX frontend I would study and break down the code that makes it happen within MODX backend.
Nikolay is very helpful. https://twitter.com/hawproductions/status/552341523921403906

Thanks will have a look.

Is there any data from Dropbox on the file sending API?

I don't think I have the PHP skills to make this work to be honest. Does anyone fancy taking this work on?

Alternatively, maybe the more achievable solution would be to only allow registered users to upload a file, then never reference its server location. As part of the upload, it should be uploaded to a random position also.