Support Forum

Hello kvr28,

thanks for your post, I re-checked all permissions and user groups but still attachments can be accessed by guests.

To clear it up: Guests can NOT see any forums/posts, not even in read-only mode! But if you know the attachment URL you can access it directly. This is a security concern for me, e.g. a logged in user can sent the attachment URL to an unauthorised person or someone checked the browser history of a previously logged in user and got the URL from there etc.

Regards, JS

Of course, a htaccess file would be required. But it could be created by the forum code when this feature is activated. It is not possible to "inform the folder"

It should be easy to implement: The forum already has functionality to check if the current user is allowed to view a post (and if he is allowed to view attachments within that post). The database already contains the path & filename of the attachment and the post ID it belongs to.
Instead of directly linking to the attachment file the uploader plugin would present a link to a download.php file with the attachment ID as parameter, pseudo code would look something like this:

$attachmentId = $_GET['id'];
$row = getFromAttachmentTable($attachmentId);
if (!$row) { die('404'); }

$allowed = checkPostPermission($row['postId']);
if (!$allowed) { die('403'); }

readfile($row['path']);
?>

Another option would be to instead of changing the URL displayed in the forum to add a htaccess to the upload folder which redirects every request transparently to the download.php, which then fetches the attachment-row from the database by querying for the requested path/filename instead of the attachment ID and then performs the steps as outlined above.

Thanks for your help,
JS

Hello together,

any news on this yet?

Another issue that came up while using the plugin: Could an option be implemented to enable opening the attachment links in a new window/tab by adding a target attrib to the attachment link?

@mr-papa of cause, it is not as simple as my pseudo code shows. The header()'s must be correctly added to display the file/image inline. As I understood there are already postinstall / postuninstall hooks in the forum code, so after disabling the feature the (previously automatically created) .htaccess could be deleted from the upload folder so normal access is not disturbed.

Sure, it would have a performance impact, the feature should be optional for those with increased security needs.
I'm aware of the unsanitized input, it was just pseudo code to outline the idea as e.g. also the die() calls should not be kept but replaced by the correct display of the wordpress 404 page.

Have a nice week,
JS