Create secure fields of type "File Upload" with Visforms
Visforms comes with a field of type File Upload which enables user to upload files on your server. This is an interesting form feature.
Important! Please keep in mind, that file uploads always bear security risks, because the are a potential means for hacker attacks. Visforms provides you with very strong security features, when working with file uploads. But there are some thing you should attend to, if you want to provide secure file uploads.
Why are file uploads potentially a security risk?
There are different mechanisms used by hackers to break into a website. One mechanisms is, to try to upload malicious executable software to the server and execute it. This is a long way, but poorly protected file uploads are the first step on the road to success. So security risks in programms that allow file uploads are scanned systematically by hackers to find a breach. And if such a breach is detected in a common programm, a vast array of websites is hacked. (You can read about that once in a while).
Why is Visfroms very secure?
Visforms implements every security mechanism and feature of the Joomla! framework to make file uploads as secure as possible and thus all of the knowledge of those experts make Visforms secure as well.
Visforms provides you with lots of options to restrict file uploads and security risks.
Actually it takes a lot to hack a website and it is very well possible to protect your website.
Define exactly which file extension can be uploaded
Go to the edit form view, tab "Advanced" and use the option Allowed file extensions to define exactly which file extensions are allowed. You should consider which extension you want to allow and set only these extensions on the list. Separate value with comma. Avoid executables like .php or .exe. If you want to, you can set an individual value for the allowed file extensions for fields of type file upload in the field configuration, that overrides the default setting of the form configuration for this specific field.
Informations about uploaded files are valuable
Uploaded files are stored in a directory of your choice and are renamed during the file upload. This prevents a malicious user from just opening the file directly and thus from executing a malicious software easily.
If you want to use this security feature, you can create an upload directory with an individual name that is difficult to guess and set it as Uploaded files directory (in form options). Please note that each directory should contain an "empty" file named index.html. You can copy for example the index.html from the images directory of your Joomla! installation. This index.html file prevents that a list of all files inside a directory is displayed when you call the direcy directly with an URL.
When you send a a recipient mail this mail usually includes user inputs as well. Especially for file upload fields there are some options to prevent, that the changed file name and/or the upload directory name is published. Set both options, Show a download link and Include file upload file, to "no" when you set up the email configuration. (Form, Tab "Mail Options"). The mail will then contain the original name of the uploaded file (from before it was renamed during the upload process) only. (Please note, that the option name "Include file upload file" is used two times, for the result mail configuration and for the receipt mail configuration. Make sure you set the right one.)
Heads up! If you enable the option Show a download link the user will receive a direct link to the uploaded file. Please consider carefully if that is really necessary and who you want to allow it!
If you enable the option Include file upload file for the recipient mail the uploaded file is attached to the recipient mail. In this case the user will know the changed name of the renamed uploaded file.
You can store user inputs with Visforms and display data views in the frontend. In relation with security features it is important for you to know that you can prevent each field individually from being displayed in this data view. Go to the edit field view and set the option Frontend display in tab "Advanced" to none. Fields of type "File Upload" come with an additional option Show a link in frontend in the tab Basic Options which allows you further control. The option is disable as default settings. You should be aware of potential security risks, when you publish upload field informations in frontend!
Some common rules to protect your website
Maybe those explanations have bent your attention in the direction of how to run a secure website and you would like to learn more.
Joomla! is one of the most secure content management systems and there is a lot of good articles about it. But that is not enough. To keep your own website secure you have to understand the potential risks and you have to respect some principle guidelines. The following links helped me a lot.
- Joomla! Documentation
List of "Vulnarable Extensions": You can subscribe for newsletters on that page as well, which will inform you about newly listed/solved vulnerable extensions. Mostly everything is calm, but it's helpful to see, when out of a sudden, many extensions are listed. This will indicate, that hackers have found a new breach in the security messurements. (And the mails about solved vulnerabilities can give you a impression on how well an extension is maintained or not.)