Limit File Types

[JInfem]

Is there a PHP file that we can modify to limit the types of files that can be uploaded by users? I want to limit them to images, so that they can't upload potentially malicious files (e.g., EXE, PHP, ZIP, etc). Allowing any/all file types to be uploaded by all users can be a major security issue. I've disabled the upload feature for now until I can get this resolved. Thanks for all of your hard work in building this chat!

[Jason]

There already are restricted file types. As far as I know, there is no real way to disable people from trying to upload any file type, but the code in the back-end checks for that and will not allow it.

ArrowChat also does not allow the direct execution or download of an uploaded file which is an additional security layer.

[JInfem]

Thanks for getting back with me so quickly. It certainly helps to know that direct execution is prevented. In my testing, I was able to upload zip, txt, and doc files, but not exe. By chance, do you know what file performs the back-end check so that we can limit it further?

[SDFltd]

I would love to know if you were able to find where to restrict the file types.

Clearly define the allowed file extensions should be a featured for future upgrades.

[RMcDowell]

I would love to know if you were able to find where to restrict the file types.

Clearly define the allowed file extensions should be a featured for future upgrades.

Any update on this

[zoxtrix]

I would love to know if you were able to find where to restrict the file types.

Clearly define the allowed file extensions should be a featured for future upgrades.

Any update on this

The uploadable file types are controlled by the file extension list at arrowchat/includes/classes/class_uploads.php

Look for the following allowed file types directive code:

Code: Select all

	// ###################### START MAIN UPLOAD SCRIPT #######################
	if (!empty($_FILES)) 
	{
		if ($file_transfer_on == 1 || $chatroom_transfer_on == 1)
		{
			$fileTypes = array('jpg', 'jpeg', 'gif', 'png', 'doc', 'txt', 'zip', 'mp4', 'rar', 'wmv', 'mp3', 'avi'); // Allowed file types

and change or add extensions to your liking.

[zoxtrix]

The current default allowed file types line for v3.0.x looks like this:

Code: Select all

$fileTypes = array('avi', 'bmp', 'doc', 'docx', 'gif', 'ico', 'jpeg', 'jpg', 'mp3', 'mp4', 'pdf', 'png', 'ppt', 'pptx', 'rar', 'tar', 'txt', 'wav', 'wmv', 'xls', 'xlsx', 'zip', '7z'); // Allowed file types

Just remove the extensions you wish to preclude.