Reported by plg on 16 Oct 2013 17:27 UTC
The upload directory should not be "browsable". As you can upload files inside, the permissions have to be "wide", it may attract intruders and let them upload unwanted files and browse them.
In the upload directory, a .htaccess file, with :
order allow,deny
deny from all
PEM source code should use readfile function for screenshots as it already does with the zip files.
Warning : we have to deal with existing remote clients (like plugin manager in Piwigo)
Reported by plg on 16 Oct 2013 17:27 UTC
The upload directory should not be "browsable". As you can upload files inside, the permissions have to be "wide", it may attract intruders and let them upload unwanted files and browse them.
In the upload directory, a .htaccess file, with :
order allow,deny
deny from all
PEM source code should use readfile function for screenshots as it already does with the zip files.
Warning : we have to deal with existing remote clients (like plugin manager in Piwigo)