0

On older drupal 7 websites I once faced security patches for the webform module, because file upload fields were considered insecure. There was en exploit where people could end up uploading .html files (via ajax) to your files storage and started spamming to those links.

I'm currently working on a drupal 8 project where anonymous users can fill in a form and upload their resume in a file field. I chose to create a content type and a custom form mode. Now the form is shown in a custom controller on the site.

My questions:

  • How (un)safe is the public exposure of a file upload field?
  • Are you aware of any steps taken in drupal 8 to further secure this?
  • Any suggestions to do this even more securely?

Thanks in advance.

Improve this question
2
  • Possible duplicate of Webform File Upload field - don't use nodes for this, use Webforms and store the uploaded file in the privare file area.
    – Hudri
    Commented Sep 27, 2019 at 16:36
  • No. It needs to be nodes. In the platform they get published. Long story :).
    – Stef Van Looveren
    Commented Sep 27, 2019 at 17:24

1 Answer 1

Reset to default
1

Drupal places an .htaccess file in the files directory to prevent files inside from being executed. Check the status report on your site to ensure that this is correctly configured.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.