search

turtlepod / fx-updater

Your Own Update Server For WordPress Themes and Plugins
https://genbumedia.com/plugins/fx-updater/
GNU General Public License v2.0
29 stars 16 forks source link

File path security. #9

Closed WPDevHQ closed 7 years ago

WPDevHQ commented 7 years ago

I'd love to use this for my projects but I'm a bit concerned about the file path's security.

How secure is it and what how to further strengthen that security to avoid unauthorised downloads?

turtlepod commented 7 years ago

file path security? what security do you refer to?

WPDevHQ commented 7 years ago

Upon uploading a file the location i.e. the upload folder - files in this folder can be publically accessible.

Would be nice to have an option to define the upload location

turtlepod commented 7 years ago

yes it is publicly available. This plugin have no restriction feature at all.

Sorry, no plan in near future to add this feature to this plugin. You can extend it, if needed. All API data are filterable: https://github.com/turtlepod/fx-updater/blob/master/includes/api/api.php

Maybe Steps:

1) create your own uploader in edit screen 2) filter the download url with your protected download URL.

WPDevHQ commented 7 years ago

Didn't notice the API.

Going to improvise with it and spin a remote server, thanks :)

turtlepod commented 7 years ago

there's also other alternative like EDD, if you need restriction feature (note: i never use it) https://easydigitaldownloads.com/downloads/software-licensing/

WPDevHQ commented 7 years ago

I'm good with - a little workaround and all is secure for my needs :)

Closing as a none issue, thanks for the input 👍