Support Forum

Security issues in the image/file uploader

JM Johan Moritz
Johan Moritz
Member
Member since Jan 2014
3 posts
Jun 17, 2014 · 6:03 am · Edited

Hi,

We are running a high traffic site and are using the image/file uploader in our simple press forum. We had some major issues to get it to work with our security settings. We are using a pretty strict settings which resulted in the upload plugin to fail when it tried to run copy() to copy the file from the temp directory to the upload directory. We replaced copy() in the forum-plugins/plupload/library/sp-upload-components.php on line 702 and instead used move_uploaded_file() which worked perfect for us.

So my question is, why is the plugin using copy() instead of move_uploaded_file() ?
Could it be updated in the next version of the upload plugin?

2 Answers

New Answer
YS Yellow Swordfish
Yellow Swordfish
Member
Member since Nov 2008
16,437 posts
Jun 17, 2014 · 11:55 am

We will have a discussion and come back to you…

MP Mr Papa
Mr Papa
Member
Member since Dec 2006
19,448 posts
Jun 18, 2014 · 12:14 am

not really a security issue per se – nothing inherently unsafe about the copy command…

but as Andy says, we will investigate the other command and have to check its applicability to various php flavors and versions (as well as *nix types), plus make sure no IIS issues (its has some weird nuances with upload temp dirs)…  thanks for the tip…