Page is a not externally linkable
- Code, Content, and Presentation
-- PHP Server Side Scripting
---- security considerations regarding upload to server from another website


enigma1 - 10:18 am on May 26, 2009 (gmt 0)


what security concerns can there be in my server trying to do a HTTP GET on a URL the member provided ?

If I understand correctly this, member sets a link for an image that points to an external site. Now as your users browse pages on your site, some images may point to an external site (whatever was specified by the image links of your members correct?

If so then we have

your site:
www.example.com

external site:
site1.example.com

Link to the image:
site1.example.com/image/my_image.gif

Here are few things that can be done.
Once the image link is set to your site member changes the content of the image to some adult content only for some ips or only on a specific time of the day.

Another case is he can set an authorization script inside hist /image folder that rotates. Now some members of your site will see a popup dialog prompting them to enter their credentials. Just use your imagination possibilities are unlimited.

So make sure of at least 2 things.
1. Make sure they upload the image files to your server (no hot-linking)
2. Validate the images.


Thread source:: http://www.webmasterworld.com/php/3917282.htm
Brought to you by WebmasterWorld: http://www.webmasterworld.com