Right now the filename appears to be advisory. A nefarious person could upload a dangerous file type (.exe) and provide a link to it to a victim with the filename in the url changed to an innocuous one (e.g. png). The code should use the id in the url to retrieve the correct datastore record then also verify the filename.
pfibiger
commented
13 years ago
Right now the filename appears to be advisory. A nefarious person could upload a dangerous file type (.exe) and provide a link to it to a victim with the filename in the url changed to an innocuous one (e.g. png). The code should use the id in the url to retrieve the correct datastore record then also verify the filename.