Vincent Puglia — Thu, 27 Jul 2000 18:13:06 +0000

Hi purplepages,

This will have to be general since I don't know what type of files you expect to upload.
1) you could check file extensions -- If you are expecting *.txt or *.doc and someone's trying to upload *.exe cancel the process. (Doesn't stop someone from renaming virusX.exe virusX.doc, though)
2) you could open & read the file; if it contains anything other than ascii characters in the alphanumeric range, cancel the process. This implies you need a cgi program that is capable of reading files. You could also use the program to check the file size and reject anything over, say, 30 megabytes
3) if you are allowing gifs, jpgs, etc, you could get a cgi program to read the header information if it doesn't jive with the appropriate data, cancel the operation.

check out http://www.cgi-resources.com for possibilities

Vinny

purplepages — Thu, 27 Jul 2000 17:57:27 +0000

I have asked my host for an upload utility, so hopefully this will do the trick (if he puts it in place!!!).

Also Vinny, how could I check it for binary data in case of virus's. Any good resource sites on the matter would be good.

Thanks.

Vincent Puglia — Thu, 27 Jul 2000 13:01:28 +0000

Hi,

Regarding:

Quote:
...CDONTS will think that this is actually on the server itself. If I'm wrong...

does this mean you tried it? If not, then try it.
Not being familiar with CDONTS, I can't really comment on what it can and cannot do. However, if your current cgi programs do not allow for attaching files, you'll have to get another -- http://www.cgi-resources.com. Also, I would be wary of allowing people to upload/attach files. In other words, I'd use a program that checks the file for binary content first and if it exists, rejects it. (Unless of course if you like playing the virus version of Russian Roulette

Vinny

John Pollock — Thu, 27 Jul 2000 02:00:54 +0000

I'm not quite sure what you are after, but it seems like the upload tool would need to be used (I could be wrong though). The only other way I know is to have them e-mail you directly and attach the file, which of course is not at all what you want...