• Resolved bradwallace51

    (@bradwallace51)


    I am testing the free plugin version currently. This is a great plugin, thank you!

    I noticed that I can go directly to the path of an uploaded file by typing in the full path in a browser such as:
    “www.test.com/wp-content/uploads/test.pdf”

    So anyone can get this file without even logging into the website. I want users to upload sensitive files. Is there some way to make access to these files forbidden? I’m not sure if anyone can find out the path to the file, but it does seem possible.

    Thanks.

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Author nickboss

    (@nickboss)

    Hi, you can change the upload path from the plugin’s shortcode. You can set it outside /upload folder and you can change permissions to that folder so that it is not accessible by anyone.

    Regards

    Nickolas

    Thread Starter bradwallace51

    (@bradwallace51)

    thanks for your reply. i tried to move the uploads out of /wp-content/ believing /wp-admin/ must be automatically protected. in any case, i couldn’t get get the file path outside of /wp-content/. (not sure if its a good idea anyway.)

    i realize this is outside of your realm here, but can you give me a clue of what direction to look for changing folder permissions? i need to change server settings somehow i’m guessing. thank you!

    Plugin Author nickboss

    (@nickboss)

    You can move the upload folder outside /wp-content like this: uploadpath=”../inbox”

    The double-dot (..) will take you one level above /wp-content folder, at the root of your wordpress installation. The above upload path will save files in folder “inbox”, located at the same level as wp-content, wp-admin and wp-includes. Please note that you cannot go above the root.

    Changing folder permissions is actually easy if you can connect to your website file structure using an ftp client (like Filezilla). Go to the upload folder and right click on it. By default permissions are 755. If you make it 750, then guests will not have access to the folder.

    Nickolas

    Thread Starter bradwallace51

    (@bradwallace51)

    I noticed that using file manager I was able to set the permissions on the folder as well (under privacy for the folder I turned off read/write/execute access for web users).
    Awesome thanks!

    • This reply was modified 8 years, 7 months ago by bradwallace51.
Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘WordPress File Upload: File Security’ is closed to new replies.