1

I made a simple HTML, JS, & PHP app to transfer files between my phone and computer. I want to host it on my personal server, but I'm worried that malicious internet browsers could access it and upload harmful files.

I've read various ways of protecting file uploads, which involve protecting against which files are uploaded and/or executed. I want to protect against which users are allowed to upload files, and trust those users (namely, me) with uploading safe files.

I put a password input in the HTML upload form, and in the PHP upload script, check that the password is equal to a set value before allowing file uploads.

Is this a safe enough protection against malicious internet browsers, providing the password is adequate? Should I be concerned of any loopholes to bypass providing the right password?

Ray
  • 457
  • 1
  • 6
  • 15
  • 1
    Sure, that'll likely work as long as you validate it properly. Typically this is solved by having user accounts in your system and limiting it to logged in people, but this will do as a solution too. – ceejayoz Aug 18 '17 at 18:48

1 Answers1

1

Short answer: in tandem with https, yes.

Long answer: you may be better off using https and some type of user authentication. This is a better user experience, but given your use case I'm not sure this is necessary. Without https and a plain password field, someone could sniff your plain text password transmission. Then a bot could figure the rest out or be taught to.

swensor
  • 631
  • 6
  • 6
  • 1
    AFAIK even with the wrong password the file uploaded would still hit your server temporarily. User authentication would solve this as well, preventing them from ever accessing the form or completing a POST request to your box. – swensor Aug 18 '17 at 18:51
  • Any files would hit the server temporarily. Good point. Could those files be dangerous just by temporarily being on the server? I got the impression they were dangerous only when executed, like when a user browses to the file url after uploading it. – Ray Aug 18 '17 at 19:13
  • 1
    Unless you've done something really stupid like building a script to crawl your `/tmp` directory and execute stuff, that's correct, they'll be safe in there. Still, you incur bandwidth usage, if that's a consideration. – ceejayoz Aug 19 '17 at 01:52
  • 1
    I'm not well-versed on buffer overflow, but my understanding is by virtue of having them loaded from a POST request and then saved to disk (and then deleted at the end of a failed request) there is potential for a buffer overflow attack. Thoughts? – swensor Aug 24 '17 at 20:11