Sennadar Forums

So many people get mad at me and msg me back, I just started a new thread for this. Plus, you'll see this better.

I've recently gotten a website, and I went and found an uploader CGI script that I can stick on there to solve the IRC problem.(DEATH TO NETSPLITS!) You can upload directly to the site, I'll leave out the index file so it doesn't have to be updated for people to find the upload, and I can set it to email whoever you want when the file is uploaded. I'll leave this script postedon my site for anyone who wants it, but since my site holds nothing of importance(and wouldn't matter too much if it got hacked), we can just put it on mine.

The URL is http://sennadar.bullspit.net/ . Just click the upload.html link there to upload. The upload script I'm using is also posted there so anyone else can download it.

adamx wrote:I'll leave this script postedon my site for anyone who wants it, but since my site holds nothing of importance(and wouldn't matter too much if it got hacked), we can just put it on mine.

It will matter if it gets hacked - your ISP/feds/etc will get very unhappy with you if someone puts warez/whatever on there. Additionally, if you're giving free-for-all upload access, it increases the likelyhood of someone 'hacking' it.

By the way - have you put uploads in a seperate directory, which doesn't have executable/scriptable access? If not - that's the easiest way for someone to 'hack' your site - just upload their own file-manager which can then do whatever they like - add/edit/delete files. And if the user your scripts run as has more access, then do all sorts of nasty things. (eg, if it's windows hosting - just plonk a .exe on there, and run that - boom-tish, you're now trojaned)

Is it possible for you to password-protect the uploads? Then just PM Fel and the other people likely to have the chapter so they can upload, but it's still protected against everyone else.

I'll have to see about putting in a password. I'll dig around for a better script with some security features.

EDIT: I've found some of the security features within the script, now it will only allow txt, doc, html, and htm, so they can't upload an exe, and all the permissions are set better now.