Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

By default WordPress restricts the file types that can be uploaded to /uploads using the default Media Manager. I know it is possible to manually extend the allowed file types. I also know it is possible to change functions.php to allow all file types to be uploaded.

This restriction obviously exists for security concerns - e.g. someone could upload a harmful .exe.

Would it not be possible to allow secure upload of all filetypes by setting the permissions of the /uploads directory to prevent execution of any of its contents? Thus it wouldn't matter if someone uploaded a harmful file because it would not be executable on the server...

share|improve this question

migrated from wordpress.stackexchange.com Jun 28 '13 at 22:14

This question came from our site for WordPress developers and administrators.

    
You know, per your question, how to cause WordPress to allow the upload of all file types. That makes this purely a server security question not specific to WordPress, at least as it seems to me. –  s_ha_dum Jun 28 '13 at 14:38
    
Yes, it's possible. Just move the uploads directory outside the root, where the uploader cannot reach it –  One Trick Pony Jun 28 '13 at 14:40
    
You could write a handler to encode the data before saving it. So every file would be encode to something (like base 64) and then you can save it as .dat file. This way nothing can be executed or run as a script because as far as the OS is concerned it's just a plain text file with garbage inside. –  Letseatlunch Jun 28 '13 at 19:27
    
@Letseatlunch that's a fantastic idea and exactly the kind of solution I was looking for!! Could such a code be done by a simple WordPress plugin? –  user34682 Jul 1 '13 at 12:46

2 Answers 2

No. Setting the directory as non-executable only prevents harmful binaries from being executed on the server. It does not prevent harmful scripts from being executed by the webserver.

If I can upload a PHP file, and access it via the web, then the webserver will run it regardless of its executable flag.

Additionally, I could upload something that contained HTML and Javascript, and then run it in a browser from your domain. This is known as a Persistent-Cross-Site-Scripting vulnerability.

In order to be secure with any filetype, the uploaded files must be uploaded to a place where the webserver cannot reach them and serve them to other people. Which makes uploads kind of pointless in that case, since images uploaded wouldn't be visible afterwards.

share|improve this answer
1  
I was about to +1 this answer until: "Which makes uploads kind of pointless in that case, since images uploaded wouldn't be visible afterwards." - the file handling should not stop there. Run a process against all files upon successful storage, and then, once deemed safe, move them to an accessible location. Assuming the files are less than 100megs - this process is mostly lean and you can triage user frustration with simple explanations of the delay. –  Brandt Solovij Jun 29 '13 at 5:26

You could write a handler to encode the data before saving it. So every file would be encode to something (like base 64) and then you can save it as .dat file. This way nothing can be executed or run as a script because as far as the OS is concerned it's just a plain text file with garbage inside.

You can do this in a WordPress plugin by first checking if the request has any files associated with the request. I do it in the "template_include" filter but there is probably a better filter/action to choose. Now to my understanding, the php script isn't run until the file is uploaded and stored in some temp location. So you can't manually handle the file bytes directly from the HTTP post data like you can in say c#/.net. So the best option is to first open the temp file and create a second file 'safe' file. Open the temp file and read it in and as you're writing it to the second file encode it. obviously the new file should have a generic extension like .dat or .txt. Hope this helps, if you need more specifics on the WordPress plugin I can try to whip something up with I get home.

I'll add that you might also consider finding a decent 'download plugin' and just modify it to your needs or at least use it as a guide/starting point to your own plugin.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.