Tweeted twitter.com/#!/StackWebmasters/status/30630107903172608
2 added 5 characters in body; added 141 characters in body; deleted 18 characters in body; added 4 characters in body
source | link

Lets say I have a website where users are allowed to upload files which will be displayed publicly, e.g. as a portfolio gallery. For example, theyusers might upload screenshots of a website they designed, or a MS Word document of some PR example text, or a pdfPDF of their CV, etc.

Some files will be blacklisted for security reasons, e.g. .zip.zip files, .exe.exe files and .php.php files.

What about flash files? Is theirthere any security concerns if I was going to host swf.swf files and automatically play them?

<?php
if ($extension == 'swf') {
    echo '<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=7,0,19,0" width="640" height="430">
       <param name="movie" value="/'.$info['file_path']$urlToFLV.'" />
       <param name="quality" value="high" />
       <param name="wmode" value="transparent">
       <embed wmode="transparent" src="/'.$info['file_path']$urlToFLV.'" quality="high" pluginspage="http://www.macromedia.com/go/getflashplayer" type="application/x-shockwave-flash" width="400" height="430"></embed>
    </object>';
}
?>

I guess the flash code is executed in the users browser, so if there was a security issue, it would be on their machines, not our server?

Lets say I have a website where users are allowed to upload files which will be displayed publicly, e.g. as a portfolio gallery. For example, they might upload screenshots of a website they designed, or a MS Word document of some PR example, or a pdf of their CV, etc.

Some files will be blacklisted for security reasons, e.g. .zip files, .exe files and .php files.

What about flash files? Is their any security concerns if I was going to host swf files and automatically play them?

<?php
if ($extension == 'swf') {
    echo '<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=7,0,19,0" width="640" height="430">
       <param name="movie" value="/'.$info['file_path'].'" />
       <param name="quality" value="high" />
       <param name="wmode" value="transparent">
       <embed wmode="transparent" src="/'.$info['file_path'].'" quality="high" pluginspage="http://www.macromedia.com/go/getflashplayer" type="application/x-shockwave-flash" width="400" height="430"></embed>
    </object>';
}
?>

Lets say I have a website where users are allowed to upload files which will be displayed publicly as a portfolio gallery. For example, users might upload screenshots of a website they designed, or a MS Word document of some PR example text, or a PDF of their CV, etc.

Some files will be blacklisted for security reasons, e.g. .zip files, .exe files and .php files.

What about flash files? Is there any security concerns if I was going to host .swf files and automatically play them?

<?php
if ($extension == 'swf') {
    echo '<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=7,0,19,0" width="640" height="430">
       <param name="movie" value="/'.$urlToFLV.'" />
       <param name="quality" value="high" />
       <param name="wmode" value="transparent">
       <embed wmode="transparent" src="/'.$urlToFLV.'" quality="high" pluginspage="http://www.macromedia.com/go/getflashplayer" type="application/x-shockwave-flash" width="400" height="430"></embed>
    </object>';
}
?>

I guess the flash code is executed in the users browser, so if there was a security issue, it would be on their machines, not our server?

1
source | link

Are there any security considerations if users are allowed to upload flash files

Lets say I have a website where users are allowed to upload files which will be displayed publicly, e.g. as a portfolio gallery. For example, they might upload screenshots of a website they designed, or a MS Word document of some PR example, or a pdf of their CV, etc.

Some files will be blacklisted for security reasons, e.g. .zip files, .exe files and .php files.

What about flash files? Is their any security concerns if I was going to host swf files and automatically play them?

<?php
if ($extension == 'swf') {
    echo '<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=7,0,19,0" width="640" height="430">
       <param name="movie" value="/'.$info['file_path'].'" />
       <param name="quality" value="high" />
       <param name="wmode" value="transparent">
       <embed wmode="transparent" src="/'.$info['file_path'].'" quality="high" pluginspage="http://www.macromedia.com/go/getflashplayer" type="application/x-shockwave-flash" width="400" height="430"></embed>
    </object>';
}
?>