I want to find out if I am on the right track.
My upload script that does the following:
- Check if the extension is gif, png, jpg org jpeg
- Check if mime is image/jpeg, image/png, image/gif
- Check if a valid file was uploaded
- Upload file to /images
- .htaccess script in the /images that disables script Execution
After that I have set the following permissions for /images
- owner/group = www-data
- Permissions = 700
- Does the last step where I set the permissions on /images make sense?
This is part of an e-commerce solution. The images that are uploaded while be shown on products, product lists etc. That means the visitors should have permisson the view the images.
I run apache 2.2 under the user www-data