I have a site which allows anonymous users to create a node with an image (the site allows people to submit images with quote memes so that the authenticity of the quote can be verified, quotefail.com).

I just learned, the hard way, that people can upload php code in the image field... somehow. That php code was then used to send out tons of spam from my server. Joy.

How can I make sure that image uploads are really, really only image uploads? This site depends on random people being able to submit images for validation, so I can't just disable the upload.

  • Is this a core image field we're talking about? – Clive Mar 23 '15 at 18:09
  • Yes, standard core image field. – Kenny Wyland Mar 23 '15 at 18:10
  • im not sure you can sniff out a real image from fake data. remove the execute bit from permissions within the files directory of drupal. write a cron task and do a scan for image file magic numbers and mime types ... and flag these images in drupal, or unpublish them. – tenken Mar 23 '15 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.