How to restrict users from uploading malicious files(exe, dll,etc) & limit file size in a webform

Question

Hello, please i have a file atachment field in a form on my site. I want to restrict the size of the file that can be uploaded and the type. It's a vacancy page and I want candidates to only upload doc and pdf files. I want to also limit the file size to 50mb only. How can this be done within the BC system.
Thanks.

Answer 1

The file extension can't be trusted, like the mime-type it can be faked by a malicious user. Also this method can just be avoided altogether by anyone who has javacript turned off. Using javascript for this is not even remotely secure.
Isn't there a way to allow file uploading but specify a whitelist of filetypes (preferably checked using byte headers or some effective method) somewhere in admin?
Liam Dilley wrote:
Hey there,
You can do the file extension with jquery for example. The basic aspect of that is:
var ext = $('#my_file_field').val().split('.').pop().toLowerCase();
if($.inArray(ext, ['exe','dll','jpg','jpeg']) == -1) {
    alert('invalid extension!');
So what is hapepning there is that it checks the value of the field when someone has added the file and checks the file extensiona and produces an alert but you can do as you need.
You could run this on hover of the submit button, on change of the actual file attachement field or on click of the submit button in the checks before it submits.
BC limits files to 100mb anyway so you should be ok on that front, they wont be able to be crazy uploading.