Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a small mailing php script and I would like to extend it with attachment function (we have a DB for our staff to get contact with them). As far as I understand I need a /tmp folder to be able to upload the attached file - but I need a write permission which would make my site weaker.

Questions:

  • How can I be sure that only the user uploads the given fileformat (without SSL)?
  • Is there any way to make sure noone else would execute a file or upload anything that is malicious?
  • do I need to delete the file after upload or it will be deleted - generally?

I work on a shared host...

Any help would be appreciated.

Andras

ps code is in PHP mail function swift mailer. - apologise for my English and the dummy question:)

share|improve this question
    
What is your question? Upload, use, delete. Where is the security issue? –  mailq Nov 14 '11 at 13:37
    
hi, thanks I added my questions as well:) –  Andras Sebestyen Nov 14 '11 at 13:51

1 Answer 1

  • Check it. file may be you (first) friend.
  • Authentication is the key. How should someone execute a file when it hasn't got the execution bit set? And not the file mode to even see the file?
  • Depends on how you implement the upload. But what would be so hard to do a delete(file) anyway?
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.