Home/ Questions/Q 5847075
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-22T12:40:01+00:00

I have a web application that allows users to upload certain documents relevant to

  • 0

I have a web application that allows users to upload certain documents relevant to their account (word/excel/powerpoint etc). I’m building this with CodeIgniter and I just wanted to check that I’m not missing anything security wise.

  • MIME types of the file are checked
  • Maximum size is checked
  • The filename is hashed
  • The filename is never seen by any user rather when clicking a “download” link, the safedownload controller is called with an ID ( http://www.example.com/safedownload/1245/ )

Is there anything I’m missing? The CHMOD of the files in the directory is currently set to 0600, is that secure?

Thanks.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Have you considered the way the files are accessed later? There is a common flaw you should be aware of-

    If the filepath can be manipulated in any way, it is possible that your server could be accessed, completely outside the folder you store the documents in- for instance ../../../etc/somefile

    To protect against this, you could check the filepath that is about to be accessed for ‘..’ to be sure noone has found a way to to get those characters in the command your code executes!

    • 0