Uploads Module Security

Have a question or a suggestion about a 3rd party addon module or plugin?
Let us know here.
Locked
als67

Uploads Module Security

Post by als67 »

Hello,
Sorry if my english is not very good  :-\
I use three modules : Uploads, customcontent and frontenduser, to put to registered users, different files. But my problem concerns the link of download of files. When we do a "click right" into the file, we can Copy the download url, but if somebody change, into this link, the upload ID, he can download whatever files, who isn't authorized.
download Url : upload_id=19[/color]&cntnt01returnid=57]http://SiteName/cmsms/index.php?mact=Uploads,cntnt01,getfile,0&cntnt01showtemplate=false&cntnt01upload_id=19&cntnt01returnid=57

I put a .htaccess in the directory Uploads, but it is only functional when we write the complete path of file.

So Can I secure the Upload link?
I hope you understand me  :-\

Thanks  :)
calguy1000
Support Guru
Support Guru
Posts: 8169
Joined: Tue Oct 19, 2004 6:44 pm
Location: Fernie British Columbia, Canada

Re: Uploads Module Security

Post by calguy1000 »

Well, in order to do this, a more tighter integration with FEU would be required with the uploads module.  It's not currently available.

off the top of my head:
  there would have to be some kind of an Access Control List (ACL) in the uploads module for each category of files.
  the getfile action would then have to check that access control list against the currently logged in user.

as I said above.... that's currently not in the uploads module.  It was designed for security by obfuscation, not real security. 
If you really seriously need this feature,  I may be able to take it on as a paid project.
 
Follow me on twitter
Please post system information from "Extensions >> System Information" (there is a bbcode option) on all posts asking for assistance.
--------------------
If you can't bother explaining your problem well, you shouldn't expect much in the way of assistance.
Locked

Return to “Modules/Add-Ons”