ArrowChat

Is there a PHP file that we can modify to limit the types of files that can be uploaded by users? I want to limit them to images, so that they can't upload potentially malicious files (e.g., EXE, PHP, ZIP, etc). Allowing any/all file types to be uploaded by all users can be a major security issue. I've disabled the upload feature for now until I can get this resolved. Thanks for all of your hard work in building this chat!

There already are restricted file types. As far as I know, there is no real way to disable people from trying to upload any file type, but the code in the back-end checks for that and will not allow it.

ArrowChat also does not allow the direct execution or download of an uploaded file which is an additional security layer.

Thanks for getting back with me so quickly. It certainly helps to know that direct execution is prevented. In my testing, I was able to upload zip, txt, and doc files, but not exe. By chance, do you know what file performs the back-end check so that we can limit it further?

I would love to know if you were able to find where to restrict the file types.

Clearly define the allowed file extensions should be a featured for future upgrades.

I would love to know if you were able to find where to restrict the file types.

Clearly define the allowed file extensions should be a featured for future upgrades.

Any update on this

I would love to know if you were able to find where to restrict the file types.

Clearly define the allowed file extensions should be a featured for future upgrades.

Any update on this

The uploadable file types are controlled by the file extension list at arrowchat/includes/classes/class_uploads.php

Look for the following allowed file types directive code:

Code: Select all

	// ###################### START MAIN UPLOAD SCRIPT #######################
	if (!empty($_FILES)) 
	{
		if ($file_transfer_on == 1 || $chatroom_transfer_on == 1)
		{
			$fileTypes = array('jpg', 'jpeg', 'gif', 'png', 'doc', 'txt', 'zip', 'mp4', 'rar', 'wmv', 'mp3', 'avi'); // Allowed file types

and change or add extensions to your liking.

The current default allowed file types line for v3.0.x looks like this:

Code: Select all

$fileTypes = array('avi', 'bmp', 'doc', 'docx', 'gif', 'ico', 'jpeg', 'jpg', 'mp3', 'mp4', 'pdf', 'png', 'ppt', 'pptx', 'rar', 'tar', 'txt', 'wav', 'wmv', 'xls', 'xlsx', 'zip', '7z'); // Allowed file types

Just remove the extensions you wish to preclude.