Need General Security Advice for Upload Module Coding

Posted: Tue Apr 11, 2006 5:18 pm

I'm new to this stuff, but I know enough to ask for advice. Smile

I am working on an upload module. I am running a 7.9 PHP-Nuke with the 3.2 patches. I have Sentinel installed.

My idea is to let the user upload a file into a holding area, and the user sends along similiar info as for the Downloads module. This info will be inserted into a new pending uploads table. Once the admin approves the upload, the file is moved to a downloads area, and the info from the pending uploads table is inserted into the existing downloads module table(s).

I've started coding the upload part and initial form and its going well. But I would like to ask the security experts here what I should do to make this script safe.

I am hoping I can make calls into the existing PHP-Nuke code base to use the security graphic. True?

I am going to filter() all the form data.

I am going to check the MIME type and file extension against configurable allowable arrays.

I am going to set up an upload area disk space quota and not accept uploads if this is exceeded.

Any advice? Thank you.

Posted: Tue Apr 11, 2006 5:31 pm

There are a number of upload modules currently available. Some cater specifically for uploading like UploadIt and others such as NSN GR Downloads which is a replacement downloads module with an upload facility and I think Enhanced Downloads Module (EDL) also has an upload facility.

You say you are new to this, so I admire your courage and you have my respect for getting this far BUT my recommendation will have to be - unless your are very experienced with PHP don't do it for use on a production site.
Use something like NSN GR Downloads and tweak that to suit your needs.

Posted: Tue Apr 11, 2006 5:51 pm

Thank you for the advice.

I've looked at UploadIt; it appears, even to my untrained eye, very simplistic and doesn't do much checking. It also has a few obvious typos and mistakes in it.

I'd like to try NSN GR Downloads, but it isn't advertised for 7.9. I also need NSN Groups, which also isn't advertised for 7.9.

Anyway, I thought I would use this as a place to learn. So, assuming you can't talk me out of it, are there some general security coding guidelines I should follow? Or should I just study the source of say NSN GR Downloads?