Is keeping uploads folder outside of 'public_html' enough to keep my application secure from malicious uploads?

Question

Although I realise there are different approaches to securing upload process, I'm still confused when it comes to basic principles. I want to allow users to upload any kind of file they want, but keep my app secure. So my question is:

Is it sufficient to store the files with their original names in 'uploads' folder outside 'webroot' and fetching them via some download.php script?

If it't not secure enough, please point me in the right direction, or suggest what additional steps I should take to make it safe. Thank you.

Answer 1

No, it isn't enough.

When you save the uploaded file, you must ensure that nothing malicious happens (e.g. if the file's "original name" was something like "../somewhere else" it might be possible to overwrite another file, including some PHP script under public_html, which would then allow a cracker to obtain a higher level of access). It's probably wisest to generate a random name or at least sanitise the original filename before using it.

In a similar way, download.php must be immune to being 'tricked' into retrieving a file that is outside the download directory.

Answer 2

It depends what you mean by 'malicious uploads'.

As Artelius suggests, even if you have a dedicated directory - AND ensure that you name the files using the basename($uploaded_name) there is still a potential for a denial of service of attack or data poisoning. Generating a unique name for the file and storing the original name elsewhere would be a bit safer.

Assuming there are no vulnerabilities elsewhere in your code, this approach should prevent your site code from being compromised - however it does provide a great resource for someone trying to attack a third party site anonymously - if they can trigger a remote include from your site.

Also, you've not said how you're going to protect yourself nor your legitimate users from users uploading virus infected files, stolen content and content which may be considered contraband in some places (e.g. porn).

C.