Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using Restlet as backend trying to create a small web app.

I am allowing users to upload their profile images, but not sure where to store them. Google tells me to store it in the file system which makes sense.

So should I store them in a public web folder in which the web front end lives? But wouldn't that allow people to access all the profile images very easily?

If i don't store the images in the public web directory, where should I store them and how do I protect them?

My server is Ubuntu server 12.04 thanks in advance

share|improve this question

closed as not constructive by EEAA, Michael Hampton, Grant, mdpc, Jenny D Mar 29 '13 at 9:23

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Nothing personal and no offense intended but this question is analogous to "What kind of sandwich should I have and should I put mustard or ketchup on it?". It's entireley subjective and is dependent on your storage and security needs and desires and that's not something we can answer for you. –  joeqwerty Mar 28 '13 at 15:18
add comment

2 Answers

up vote 1 down vote accepted

You could certainly store them in a sub-folder within the public folder, and disable folder browsing. Then only expose the images within your application.

share|improve this answer
add comment

You can store the files outside of the document root, and include them on the backend with a relative path. Typically, web server will deny access to the parent directory of docroot, but the backend services will be able to access them.

i.e if you use:

DocRoot = /var/www
Images = /var/profile-pics

This will not work:

http://www.yourdomain.com/../profile-pics/David.JPG

This will work:

<?php include('../profile-pics/David.JPG'); ?>

Note: PHP used as example, and of course you cannot include a jpeg in this manner. Used only as example of keeping sensitive files out of the document root.

share|improve this answer
    
You can do this, but it exacts a severe performance penalty for calling PHP just to load a static resource. –  Michael Hampton Mar 28 '13 at 17:05
    
You are definitely correct. I just wanted to provide the example, as some users would never know otherwise. This method is best used for including other scripts that would need to be parsed regardless. –  David Houde Mar 28 '13 at 17:12
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.