Page 1 of 1

Uploads Module Security

Posted: Wed Mar 21, 2007 9:16 am
by als67
Hello,
Sorry if my english is not very good  :-\
I use three modules : Uploads, customcontent and frontenduser, to put to registered users, different files. But my problem concerns the link of download of files. When we do a "click right" into the file, we can Copy the download url, but if somebody change, into this link, the upload ID, he can download whatever files, who isn't authorized.
download Url : upload_id=19[/color]&cntnt01returnid=57]http://SiteName/cmsms/index.php?mact=Uploads,cntnt01,getfile,0&cntnt01showtemplate=false&cntnt01upload_id=19&cntnt01returnid=57

I put a .htaccess in the directory Uploads, but it is only functional when we write the complete path of file.

So Can I secure the Upload link?
I hope you understand me  :-\

Thanks  :)

Re: Uploads Module Security

Posted: Wed Mar 21, 2007 2:42 pm
by calguy1000
Well, in order to do this, a more tighter integration with FEU would be required with the uploads module.  It's not currently available.

off the top of my head:
  there would have to be some kind of an Access Control List (ACL) in the uploads module for each category of files.
  the getfile action would then have to check that access control list against the currently logged in user.

as I said above.... that's currently not in the uploads module.  It was designed for security by obfuscation, not real security. 
If you really seriously need this feature,  I may be able to take it on as a paid project.