2010/2/8 Éric Rogé <[email protected]>:
> I've added a new todo on Symfony Check :
> http://symfony-check.org/permalink/protect-yourself-against-user-uploaded-files
>
> My english can be pretty sloppy sometimes, corrections are welcome.


Hi Eric,
For the record, you should add to your documentation that this
security is only working for admins using Apache + mod_php4 | mod_php5
as php-cgi, php + fastcgi, lighttpd + php, or nginx + php won't be
secured this way.
You should also add that it is mandatory that the .htaccess has 4xx
rights, to prevent somebody from uploading a .htaccess over it, if no
proper sanitazing is done on the filename.

You can also add, i think, that the best way to secure the upload is
to move the upload dir out of the web dir... (@Krzys, thank you, I was
feeling alone ;))

Regards,
Florian MAURY

-- 
You received this message because you are subscribed to the Google Groups 
"symfony developers" group.
To post to this group, send email to [email protected].
To unsubscribe from this group, send email to 
[email protected].
For more options, visit this group at 
http://groups.google.com/group/symfony-devs?hl=en.

Reply via email to