How to allow image file uploading, but protect the directory from abuse?

I have an upload facility that allows visitors to upload their personal image (aka avatar) to my client’s site. This required me to CHMOD the assets folder to 777 which leaves the folder wide open to abuse.
Is there a way to allow the uploading of files but protect the directory from abuse?
I could put the images in the database but I assume that would quickly drag down the performance of the (MySQL) database.
Any ideas?!
Thank you in advance,
Glenn.

This required me to CHMOD the assets folder to 777 which leaves the folder wide open to abuse.
Only if the abuser can get an executable file of some sort into that folder. If you are filtering the files during upload to select only image files then I think you are pretty safe.
I could put the images in the database but I assume that would quickly drag down the performance of the (MySQL) database.
Definitely - you would never want to store the images as blobs unless you had a compelling reason to do so. It's much more forward thinking to just save the image filenames in the database, and link to them as needed.

Similar Messages

I need to change my image file size but keep the same pixels. Possible?

I'm trying to upload an image to a mobile ad platform (Adfonic) with the following requirements: Image dimensions 216 x 36 pixels; max file size 3.0 kb; file formats supported GIF, JPG, PNG. I figured out how to change the pixel size but now my file is too big. I have Photoshop CS4 Extended & Vista.
I changed the file resolution but then the pixel size changes. What can I do?
Thanks!

Save-As, JPEG offers you a quality slider. You trade quality for size. This still wouldn't give you what you needed?
You could try JPEG 2000, but beware, it's not as compatible with as many things, and it can look kind of weird, but boy does it compress...
-Noel

How do I save file thats playing on the screen from the internet that uses flsh player

How do I save a video streaming from the internet being played by flash player?

Ant Video Downloader for Firefox (it's NOT available for IE)

Truly dumb question. How do I get PS to actually complete a command, eg straighten an horizon, and finalise the change. Even doing a "save as" with a new file name and reloading brings the image back, straightened, but with the skewed back ground frame st

Truly dumb question. How do I get PS to actually complete a command, eg straighten an horizon, and finalise the change. Even doing a "save as" with a new file name and reloading brings the image back, straightened, but with the skewed back ground frame still there. Is there a "apply change" or similiar command that I simply cannot see.

brings the image back, straightened, but with the skewed back ground frame
PSE did what you told it to do. Choose the Straighten and crop edges or fill edges options when you use the straighten tool if you want it to do more than just straighten the contents of the image. Many people prefer the plain straighten because they'd rather crop themselves than let PSE do it.

Image file upload code

Hi,
I'm trying to track down where, i.e. by which code, image files are saved into the wiki.
I've traced the route to the wiki.js file which creates the dialogue that posts the form to the server but I've run into a wall.
I can't establish the name of the 'action' for the form.
Nor can I infer which python code is receiving it.
Can anyone help?
p.s. The reason for all this is that I want uploaded files to be namable, either manually or driven by a field in the form.
I guess this may involve rewriting some Python and I know that this is frowned upon but the look-out is mine!
p.p.s. It would also be nice to know where dialogManager() is defined, that's got me beaten at the moment.

John Anderson1 wrote:
Remember that, when changing the code, you should override the code using your own theme; don't change it directly. Changing the uncompressed JavaScript won't work anyway; the server sends out code-compressed scripts whenever possible. Changing source code maintained by automatic software updates is the first of many steps down the path toward a bricked server.
Yes, I'm starting to get a hang of this (I think) I do intend to override the js, it's just I need to know how it's doing it in order to overrride it!
The form's "action" is "images"
I'd sort of deduced this but I can't find the code on the server that implements it. I did a quick search and couldn't find "images' in Python and deduced I was being a bit simplistic.
and dialogManager is defined in widgets.js:
var ModalDialogManager = Class.createWithSharedInstance('dialogManager');
Ah, thanks, I'll follow it up.
You do know that you can just name the file in the Finder before uploading it, right?
Not really. Under certain circumstances I want teamsserver to save the image file, in the page's image folder, with a particular name, i.e. NOT 123456.gif but pageImage.gif. I recognise that one has the potential problem of duplicate filenames but I'm happy to overwrite existing files AND I'm quite happy for teamsserver to give the file a unique name (presumably for internal database purposes) and make a duplicate of the numbered filename. i.e. save 123456.gif as per normal and then, if some condition is met (e.g. the alt name == pageimage) save a copy as pageImage.gif
(If you're interested, I've managed to get search to take an additional parameter xslFile=1...5 which selects alternate search.xsl files that return different search layouts. One of which substitutes page specific images instead of the generic 'snowflake' image in search listings. Currently I have to give each page a tag that specifies what the pageImage uid is, but this is wasteful as every tag in every page is therefore different. What I'm trying to do now is make the pageImage filename consistent so that I have a single tag that indicates every page that has an associated image. (The custom search.xsl files recognise if a page HAS a custom image and uses the snowflake if it doesn't)
Basically it allows me to generate slightly more attractive listings - nothing big but nice for my 'list of published books' page. Vanity, vanity)
Thanks for hte help. I'll follow it up tomorrow.

Image / file upload error cannot upload image even after setting write permissions

Hi there everyone
I am having this problem when I try to upload a file (image file) to my server
I have a dynamic for working fine , all the other fields insert the information ok then I try to add an image upload behaviour to a file field
When I try to upload the file I get this error
Error:
An error occurred while inserting the records.
File upload error: File upload error. Error creating folder..
File upload error. Internal error.
Developer Details:
tNG_multipleInsert error.
An error occurred while inserting the records. (MINS_ERROR)
File upload error: PHP_UPLOAD_FOLDER_ERROR
File Upload Error. No write permissions in "../../productimages/" folder.
(FILE_UPLOAD_ERROR)
So I login to my server and change the write permissions to 777 and then try again and get the same message
I have closed DW and tried again and still get the same message......
I think I have followed all the steps correctly..... I have done the same type of forms many time and tested them locally on WAMP testing server and all work ok......
So..... Anyone got any ideas
Any help would be great
Have a nice day

On 5/17/07 4:26 PM, in article [email protected],
"Gü[email protected]" <> wrote:
>
> To my experience servers behave differently -- on some I really had to use
> 777, others are happy with 755.
>
> in regards to "any user" :: On most ADDT respectively MX Kollection - based
> backends I made the image & file upload feature available to user having e.g.
> the "levels" 1 & 2, but not 3 -- I wouldn´t expose something like this to all
> users
>
> Günter Schenk
> Adobe Community Expert, Dreamweaver
My backend is only for admin, so they are the only ones who can access the
upload pages. My concern is an images folder on the site being 777. Can't
anyone from the outside plant a file in that folder if they just know where
to find it using an ftp program? ?

How do I get photos from the iPhoto import folder to the iPhoto library? It uploaded, but hung while deleting from my camera, so no imported photos are in the iPhoto library.

How do I get photos from the iPhoto import folder to the iPhoto library? It uploaded, but hung while deleting from my camera, so no imported photos are in the iPhoto library. I watched it upload about 400 photos, one by one. They're somewhere, but they don't appear in the iPhoto library. As iPhoto was deleting them from my camera, it got hung up, then a message came "you should eject before disconnecting a device." I hadn't touched the camera. The message came by itself. I couldn't get iPhoto to respond, so I disconnected the camera and did a Force Quit. Opening it back up, the pictures were gone. Can somebody help me?

What version of iPhoto are you running? Assuming it's iPhoto 9 or later Apply the two fixes below in order as needed:
Fix #1
1 - launch iPhoto with the Command+Option keys held down and rebuild the library.
2 - run Option #4 to rebuild the database.
Fix #2
Using iPhoto Library Manager to Rebuild Your iPhoto Library
1 - download iPhoto Library Manager and launch.
2 - click on the Add Library button and select the library you want to add in the selection window..
3 - Now that the library is listed in the left hand pane of iPLM, click on your library and go to the Library ➙ Rebuild Library menu option.
4 - In the next window name the new library and select the location you want it to be placed.
5 - Click on the Create button.
Note: This creates a new library based on the LIbraryData.xml file in the library and will recover Events, Albums, keywords, titles and comments but not books, calendars or slideshows. The original library will be left untouched for further attempts at fixing the problem or in case the rebuilt library is not satisfactory.
OT

How to download a file uploaded in the portal admin console

Hi All ,
I have created a content using admin console.
It has a property called , "file", and it is of type "Binary".and its primary property
I need to have link in JSP , to download that file/content.
I am using <templates tag , but not able to download.
Could you pls suggest how to download a file uploaded to admin console
Thanks & Regards,
Srinivas

Srinivas,
Check the WLP API http://e-docs.bea.com/wlp/docs102/javadoc/index.html?overview-summary.html
Search for com.bea.content.manager.servlets.ShowBinaryServlet class and com.bea.content.manager.servlets.DownloadBinaryServlet class. You can use one of these depending on your requirment. I think there is not jsp tag for these classes so you have to use scriptlets.

How to add image file while creating addon...pathsetup?

Hi friends,
i have a problem while creating addon.
while creating addon we can add all the files(.vb,xml).but if i add image files(.bmp,.jpg)they are not displayed in runtime.
--how to add image file while creating addon..?
we are useing SAP Business One 2005A(6.80.317)SP:01 PL:04

Somebody knows like I can indicate to him to a button that I have in a form, that accedes to the image in the route where will settle addon? I have this, but it does not work to me
oButton.Image = IO.Directory.GetParent(Application.StartupPath).ToString & "\CFL.BMP"

How do I share files uploaded into the Creative Cloud with other creative cloud members?

How do I share files uploaded into the Creative Cloud with other creative cloud members?

Should be easy. Try this...
In Thumbnails view, click the little triangle (pointing downward) in the lower-right corner of the asset you want to share.
In the blue icon bar that appears, click the Share icon (the third icon from the left, just right of the trash icon). The Share dialog should pop up.
In the Share dialog, enter the email address of the person with whom you want to share the asset, then click the Send Email button - they'll receive an email with a link to your asset. OR
You can also copy a link to the asset and then paste that into your own email client if you prefer. To do that, click the Link icon (looks like a "chain", and is to the right of the email "envelope" icon) - then click the Copy Link button.
Note that the Share options won't be available if your asset is set to "Private" - you can control whether an asset can be viewed (or downloaded) by others by clicking the Public/Private control (green or red "lock" icon).
You can also access the same Share controls if you click on the file to see it one-up (you can do this from either Thumbnails view or List view); click the Share icon near the upper right corner of the browser window (to the right of the asset name).
Hope that helps.

How do I copy files onto a hard drive (device) from Mac 2 7 pc. I'm able to transfer files from device but cannot transfer files to device. Anyone had same problem or can help solve this problem? Help pls

how do I copy files onto a hard drive (device) from Mac 2 7 pc. I'm able to transfer files from device but cannot transfer files to device. Anyone had same problem or can help solve this problem? Help pls

Welcome to Apple Support Communities
When you try to copy data to the external drive, what happens? If you don't see any error, the external drive is formatted in NTFS, and OS X can't write in it.
To be able to write on this external drive, you have to use an app like Paragon NTFS. Another solution would be to format the external drive in FAT32 or exFAT with Disk Utility > http://pondini.org/OSX/DU1.html Make sure you copied all the files of the external disk to the internal disk before doing it

How to send image file through mail without any attachment

Plz tell me how to send image file through mail without any attachment ( i mean not converting that image into pdf or any format ) i want to send that text or image through mail .

Hi Sandeep,
I think you can setup the type of email in Shared office Settings in transaction S016.
There is an option called <Preset document classes>
You choose this pushbutton to branch to the maintenance screen for the document classes that are directly displayed to users in the Business Workplace for selection when they use the Create function. The name under which the documents are displayed can also be maintained.
http://help.sap.com/saphelp_nw70/helpdata/en/6c/69c30f418d11d1896e0000e8322d00/content.htm
Haven't tried it though.
Regards,
Siddhesh

I am trying to stream music from my iMac using iTunes music files to my Cocktail Audio X10 music streamer. I have allowed my files to be shared the X10 sees the files but when I try to accsess them it gives me the message files not mounted. Please help?

I am trying to stream music from my iMac using iTunes music files to my Cocktail Audio X10 music streamer. I have allowed my files to be shared the X10 sees the files but when I try to accsess them it gives me the message files not mounted. Please help?

No, I have the music I want to move from the laptop to the phone selected. Then I go under file, devices, and try to click sync but it is not available to click.

Security implication of 'Allow Public File Upload' to Yes

Hi
I am concerned about setting 'Allow Public File Upload' to Yes. Per the help text "Select Yes to permit unauthenticated users to upload files in applications that provide file upload controls. Select No to prevent unauthenticated users from uploading files in applications that provide file upload control"
That means anyone who has access to the URL can upload files of any type in to the application without any authentication.
Is this true?
Is this not a security risk in that case? Are there any alternatives which would allow 'authenticated' users to upload files via apex application.
Thank you
Kumar

Hi
Can you explain in detail? Sorry I am not an apex developer and as a DBA I was asked to set this setting in apex and since this affects all workspaces (and all apex applications) I was concerned about this.
I think we can have a custom procedure that checks to see who is uploading. One such example is given here
http://www.mandsconsulting.com/oracle-apex-tutorial-8-up-and-downloading-files-part-2-video-training
Also another concern is this
Allow Public File Upload [YES | NO] This applies only to applications that do not use any type of authentication, so that all users are anonymous. At first glance, file upload into the database seems relatively harmless, since the first threat that comes to mind is someone uploading a file with a virus, yet there is no way to execute a file inside the database that mitigates this risk . However, consider the possibility of someone uploading a bunch of large files. At the very least, this will be very resource intensive At some point, the tablespace used by the APEX_FILES schema will fill, which is essentially a denial-of-service attac

How to store image files in oracle DB

Hi,
I am new to working with database.
Please let me know how to store image files in Database using insert command.
Thanks,
Ramesh Yakkala.

Hi,
You need to create a directory object to import these files:
Take a look on the example below:
eg:
CREATE TABLE MY_IMAGE_TABLE (
ID NUMBER,
NAME VARCHAR2(20),
IMAGE BLOB);
CREATE OR REPLACE DIRECTORY IMAGES AS '/tmp';
GRANT READ, WRITE ON DIRECTORY IMAGES TO PUBLIC;
CREATE OR REPLACE PROCEDURE load_file_to_my_table (p_file_name IN MY_IMAGE_TABLE.NAME%TYPE) AS
v_bfile BFILE;
v_blob BLOB;
BEGIN
INSERT INTO MY_IMAGE_TABLE (id, name, image)
VALUES (1, p_file_name, empty_blob())
RETURN doc INTO v_blob;
v_bfile := BFILENAME('IMAGES', p_file_name);
Dbms_Lob.Fileopen(v_bfile, Dbms_Lob.File_Readonly);
Dbms_Lob.Loadfromfile(v_blob, v_bfile, Dbms_Lob.Getlength(v_bfile));
Dbms_Lob.Fileclose(v_bfile);
COMMIT;
END;
SQL> execute load_file_to_my_table('myfhoto.jpg');Cheers

How to allow image file uploading, but protect the directory from abuse?

Similar Messages

Maybe you are looking for