http://www.plupload.com – “Allows you to upload files using HTML5 Gears, Silverlight, Flash, BrowserPlus or normal forms, providing some unique features such as upload progress, image resizing and chunked uploads.” This is the uploader used in current WordPress v3.4.1 and the best one out there in my opinion.
It comes with upload.php file (full file: http://ideone.com/xbPUS).
I have doubts about its security: When I have upload.php on my server and even if I don’t setup any Javascript for Plupload anyone is still able to relatively easy send request to upload.php file and upload anything, anytime… TRUE OR FALSE?
How do I prevent that?
It’s not a security issue. Across the internet you can try to upload anything you want to servers (addresses) that support POST method. It’s up to server-side software to accept or reject such upload – it’s always been this way. Of course there can be some restrictions put onto who uploads what (using tokens, authorization etc), but that’s up to you (as developer) to handle.
As to upload.php file from plupload, I think it’s suppose to be just a quick and dirty example, that makes trying out plupload a little bit easier.