My website would like users to upload their photos…but how do I keep our server safe from harm? Allowing only JPGs should avoid virus trouble, but what if someone selects a 10Gb file – will that slow the whole website down?
We’re using Classic ASP and IIS6 (sorry, but that’s how it is, can’t change that!). Previously we have used a DLL from a company called Persits to handle uploads. However, it would be helpful to other people if we extend this discussion to other languages/technologies too.
ASPs cannot detect the size of a file until it has finished uploading, so thats a pain. Or can I check content-length in the HTTP header before I start the transfer?
Q1. Are there any other ways someone could abuse the upload facility?
Q2. How can I limit the danger to keep the site running and the server safe?
Thank you.
In Persists, you can set the maximum filesize a user can upload:
The ‘True’ above shows that the file is to be rejected if over the Max size. If set to False then the file will be trucated.
See http://www.aspupload.com/object_upload.html#SetMaxSize