Tag Info

Hot answers tagged

7

There is no direct threat from having Thumbs.db uploaded, even if people were able to download them they wouldn't get any information worth having. It does maybe highlight an issues with your upload process though, this is one of the reasons why FTP is an inefficient way to upload files, extra files that you may not have intended to upload will go up.


5

First, you need to have something in the Privacy Policy/Terms of Service about what you intend to do. If you intend to file a report with the NCMEC. What information you intend to disclose with/without search warrant, etc. I would recommend that should a User upload a child porn image, immediately make it inaccessible to the general public. You should then ...


4

MediaFire, FileDropper, Wuala, box.net, and Dropbox all allow file upload and sharing of public download links. See also this comparison of file hosting services on Wikipedia.


4

I do know flash and yes this is a terrible idea! This is what started all the trouble for myspace with self replicating virus worms. It's really simple, with flash I can get your browser to make all sorts of calls/connections/login to sites/post things as you/etc. It's amazing how much you can pull off a user with flash and report it back to any ...


4

You need estimates of how much space this LOT of uploads will take, and how quickly it will grow, and whether you are willing to do it yourself or pay more to have it made. Doing it yourself will get you in the region of: A case with lots of disk bays Server innards Cheap server class SAS disks Maybe £1,200-£2,000 for 4-6Tbs of RAID5 storage with all ...


4

You might want to start by looking at Amazon S3 as an option for your data storage rather than storing it on your own servers. There are many hosting companies that say they offer "unlimited storage", but if you start filling up a server with terabytes of data, I can pretty much guarantee they are going to shut you down.


4

FTP stands for File Transfer Protocol. It provides a method for passing bulk data to a server. There are a number of tools available that you can use to perform FTP uploads to your hosting provider. A popular choice is FileZilla - a free open source FTP program which has fairly good documentation and is available across most popular platforms. It's ...


3

I still think this file can be threat in some cases. e.g.: it is a security hole when you don't want everyone to know the full image list you have in specific directory the Thumbs.db compromises this information. It stores information about the file names, modification times, thumbnail images can be fetched from it as well.


3

There is an open source php5 project similar to yousendit that you might be able to get some ideas from: http://zend.to/ This solution works nicely if you are not going over 2GB file uploads, and works okay for larger uploads as long as you are aware of the limitations of http uploads using browsers: Not all browsers support file uploads greater than ...


3

If it's not too complicated, you could make a "screenshot" of it and post that on the page. They can save the image, but not the actual text/content. Another small trick is placing a transparent div over it, disabling the right click for less tech advanced users. You could also make a getMeTheFile.php and use that to get the files. In that PHP file, check ...


2

Someone on the Magento forums posted the following as their solution: You have to change both post_max_size and upload_max_filesize in the php.ini And don’t forget to restart your server afterwards.


2

We, a London based Advertising Agency, are using a Danish based service called Filecamp to share files and collaborate with our clients. I'm quite sure it comes with unlimited users and bandwidth, it's brandable ... and I think it´s well worth the small monthly fee. Our designers love it and our clients love it! We actually used combination of YouSendit, ...


2

Put the files outside of the webroot. Then using PHP pass the file though a script. Sample PHP: <?php $file = '/full/path/to/useruploads/secret.pdf'; header('Content-Description: File Transfer'); header('Content-Type: application/octet-stream'); header('Content-Disposition: attachment; filename=' . basename($file)); ...


2

Personally, I have good experiences with plUpload, from the guys of TinyMCE. User experience is pretty good, considering my very non-technical user base. If you consider paying, the MCImageManager is (IMO) a good choice (same guys).


2

I use VSFTPD on my servers which is easy to configure for real and virtual users, plus its very secure. Open vsftpd.conf file: # vi /etc/vsftpd.conf Set download_enable to NO: download_enable=NO Save and close the file. Restart vsftpd ftp server: # /etc/init.d/vsftpd restart


2

No. Setting the directory as non-executable only prevents harmful binaries from being executed on the server. It does not prevent harmful scripts from being executed by the webserver. If I can upload a PHP file, and access it via the web, then the webserver will run it regardless of its executable flag. Additionally, I could upload something that ...


2

I definitely do not recommend encoding the uploads and storing them in a relational database, that's just introducing a lot of overhead and complexity for no gain. File systems were designed for files :) You definitely want to design this to be flexible, because today you might use your own server, tomorrow AWS, and months from now a CDN. Or any combination ...


1

You will find this information in Cpanels raw access logs. View the FTP logs If you need to see who has accessed your site with FTP, you can view this information in the raw access log files for your website. You can download these log files from the cPanel Raw Access Logs screen. FTP logs will include ftp_log in the filename. PICK ...


1

You can circumvent upload and post limits if you start at the client side. A lot of Flash apps, JAVA apps and JS examples exist, if you google, like "multi upload chunk", things like that. It depends on your preferences, here is a Javascript example: http://creativejs.com/tutorials/advanced-uploading-techniques-part-1/ And a Flash one: ...


1

There is 2 methods that I believe will work for overcome this problem. Method 1) Edit the php.ini If the problem is that it seems that your web hosting does not support more than 30mb then it could be the fact that you just need to increase the maximum allowed amount in the php.ini file. You can edit the php.ini and change the values to: ...


1

Wordpress now has multiple uploads into it's media manager. There are quite a few options for auto-generated gallery plugins like this one and you can implement the excellent timthumb script for automatic image optimization. Both of these solutions have worked well for me on several sites. If you relent on an FTP based solution the Grou Random Image ...


1

If unbreakable anonyimity isn't an issue and you're using Apache, try creating a page with any php upload script and password protecting it with htpassword. I've used this as simple trick for family members before, if logging in is an issue you could just skip that part. I'd also check hotscripts for other ideas.


1

I do not agree with the other answers. In some cases this is a low security risk but it could have a hugh impact. It is similar to allow directory browsing. The attacker gets a list of file names that could be really bad if you think about a page like Facebook where images are pseudo hidden by there name. If there would be a Thumbs.db in this folder you ...


1

Akamai offers a Content Control Utility (with an API) which could be used to alert its crawlers to content on your servers which needs to be populated to edge caching servers. Presumably the sales guy was either not familiar with some of the technical aspects of his company's offerings or, more likely, he was trying to direct you to a third-party reseller ...


1

Simple way, download a 10MB/100MB file from here: http://cachefly.cachefly.net/10mb.test or http://cachefly.cachefly.net/100mb.test and save on your PC. Then just time the upload/download to the website in question. Say you use the 10MB and it takes 70 seconds to upload. Then the speed is 10/70 = 0.142857 MB/s = 146.2857 KB/s


1

There is no reason a standard file input field couldn't handle files up to 2GB (above that, however, things may get tricky). Most servers, however, are configured by default with a fairly small hard limit, which is there to limit excessive resource usage. What would kill you is the lack of any decent progress indicator for the user. Submitting a normal ...


1

I'm not a Flash programmer, and I know that Flash has a weird way of handling cookies/sessions (I think it uses your IE sessions regardless of which browser the plugin is being run from), but you may still have some potential CSRF/XSS problems. The problem I foresee is a user uploading a malicious Flash movie that can then be used to launch CSRF attacks ...


1

I would say yes there are security considerations of allowing users to upload flash files. The security issues may not be internal - by that I mean a threat to your server, but if your website is hosting flash files which can comprimise a users machine, or something equally nasty then your likely to experience problems building/maintaining a user-base or ...



Only top voted, non community-wiki answers of a minimum length are eligible