Uploaded files and security

[Ifremer]

Hi,

I’ve discovered that when we delete a form’s submission with an uploaded file, that file is never deleted and it doesn’t show in Media gallery, so we have no way to delete it (except file with a file deletion on the server). So, it’s not quite RGPD compliant.

Another thing : access to files aren’t protected to non-connected user, and filenames are preserved on upload so it can be guessed, and in fact, the files may also be indexed by search browser if robots.txt isn’t configured to block this stuff (and it’s worst if Apache is configured with +Indexes…)

Examples of search with Google:
inurl:iphorm ext:pdf
inurl:iphorm ext:xlsx
inurl:quform ext:pdf
…

For our platform, I’ve mitigated this with a strict robots.txt file, robot noindex meta and Apache “-Indexes”.

For restricted access to files, i’ve just found this stuff but I’ve not tested :
https://github.com/orbisius/orbisius-wp-media-protector

For files deletion, I’m searching a solution !

[Ally]

You don't have permission to view this content. Please log in or register and then verify your purchases to gain access.

[Ifremer]

Thank for the reply! I’ve protected the upload folder with Apache authentication.

The delete file option will be great!

[Author]

Posts