: A safe way to allow upload of all file types? By default WordPress restricts the file types that can be uploaded to /uploads using the default Media Manager. I know it is possible to manually

@Kevin317

You could write a handler to encode the data before saving it. So every file would be encode to something (like base 64) and then you can save it as .dat file. This way nothing can be executed or run as a script because as far as the OS is concerned it's just a plain text file with garbage inside.

You can do this in a WordPress plugin by first checking if the request has any files associated with the request. I do it in the "template_include" filter but there is probably a better filter/action to choose. Now to my understanding, the php script isn't run until the file is uploaded and stored in some temp location. So you can't manually handle the file bytes directly from the HTTP post data like you can in say c#/.net. So the best option is to first open the temp file and create a second file 'safe' file. Open the temp file and read it in and as you're writing it to the second file encode it. obviously the new file should have a generic extension like .dat or .txt. Hope this helps, if you need more specifics on the WordPress plugin I can try to whip something up with I get home.

I'll add that you might also consider finding a decent 'download plugin' and just modify it to your needs or at least use it as a guide/starting point to your own plugin.

Vote Up Vote Down

@Cofer257

No. Setting the directory as non-executable only prevents harmful binaries from being executed on the server. It does not prevent harmful scripts from being executed by the webserver.

If I can upload a PHP file, and access it via the web, then the webserver will run it regardless of its executable flag.

Additionally, I could upload something that contained HTML and Javascript, and then run it in a browser from your domain. This is known as a Persistent-Cross-Site-Scripting vulnerability.

In order to be secure with any filetype, the uploaded files must be uploaded to a place where the webserver cannot reach them and serve them to other people. Which makes uploads kind of pointless in that case, since images uploaded wouldn't be visible afterwards.

Vote Up Vote Down