views:

37

answers:

1

I was wondering, if I was making a file or image hosting/transfer site, whether or not there was a good approach to check for viruses for files that users are uploading?

I was thinking of this:

  1. Use traditional PHP file upload form to upload the file to the server.
  2. Put files in a queue folder
  3. Move the queue folder to a "process" folder, and replace queue folder after a predetermined limit (time, cronjob, file count, collective file size)
  4. Run a command line virus scan on files in process folder
  5. Place safe files in holding area for use

Is this a good approach?

A: 

I see nothing wrong with this approach.
I did something similar (just looking for executables) a while back. The only difference was that we checked the uploaded file as soon as possible.

Nifle