Create secure file upload fields
Configuration of safe fields of type “File Upload” in Visforms
You can define fields of type “File Upload” in Visforms. This enables the website user to upload files to your server using the form. This represents a functionality that can be used in a variety of ways for a form.
Warning: However, you must be aware that a file upload by a user is always associated with a certain security risk. It is a potential gateway for hacker attacks. Visforms offers you the greatest possible security when using upload fields. However, there are a few things you should keep in mind if you want to offer secure file uploads.
Why can file uploads be dangerous?
There are several ways hackers try to break into a website. One mechanism is to upload files containing executable malicious software to the server and ultimately execute it.
This is a long way, but poorly protected file uploads are the first step to hacking success here. Therefore, the hacker scene specifically searches for security defects in programs that allow file uploads. And when such are found in widely used programs, it often results in large number of websites being hacked.
Why is Visforms very secure?
Visforms uses all the security mechanisms and procedures of the Joomla Framework to make file uploads as secure as possible. All the knowledge of the experienced Joomla security experts also makes Visforms secure.
Visforms offers you many file upload control options that allow you to further secure uploads. Because for an attack on your website to be able to cause damage in this way, a lot of things have to come together. You can protect yourself against that.
Specify exactly what type of file is allowed to be uploaded
In the Edit form view, under the Advanced tab, use the list in Allowed file extensions to specify which type of file may be uploaded. Think carefully about which file extensions you allow and limit the list to exactly those values.
All file extensions are entered as a comma-separated list. Don’t list so-called “executable” files like .php or .exe. If you want, you can also specify a different list of permitted file extensions in the field configuration at field level. This setting for this specific field overrides the default from the form configuration.
Information about uploaded files is valuable
If a file is uploaded with Visforms, it is stored in a directory of your choice and then renamed. This prevents a malicious user from accessing the uploaded file directly via the browser and possibly starting the execution of malware. Because the name of the file and the storage directory are unknown to him.
If you want to use these protective mechanisms, then it is best to create a directory with a name that is not easy to guess as the upload directory. Specify this directory as the upload directory in the File upload directory form option.
Also note that each directory should contain an “empty” index.html file. For example, you can copy the index.html file from the images-directory of your Joomla installation. This file prevents a list of the files contained in the directory from being displayed simply by opening the browser. In this way, the names of the files, especially those of executable program files, remain hidden from a hacker.
You can also send the transmitted form data to the user of your website in the email for the website user. For this email you can set the two options Show download link and File upload files to “no” in the form configuration under the “Email configuration” tab. Only the original file name before the renaming is then displayed in the email.
Please note that there is an option “File Upload Files” for both the result mail and the user mail. So please make sure you set the correct option.
Caution: If you set the Show download link option to "yes", the user will receive a direct link to the uploaded file. Think very carefully about whether this is really necessary and who you allow it to do!
If you set the File Upload files option for the Email to the website user to “yes”, the uploaded file will be attached to the email to the website user. A website user also receives the file name after uploading, i.e. the name of the renamed file.
Note: The Show download link option is used to control the result mail (to you) and to control the mail to the website user at the same time. But you can set the option File upload files for the result mail to "yes". You will then receive the uploaded file as an attachment to the email, giving you easy access to the file.
Visforms offers the possibility to save transmitted data and later display it in the frontend. For detailed instructions, see the article on saving form data: Store and use data. In connection with the security of upload fields, it is important that you can individually specify for each form field in the Edit field view under the Advanced tab whether it should be displayed in the frontend or not.
For fields of the File Upload type, there is also the option Show in frontend link in the Basic settings tab, which is deselected as the default. You should be aware of security risks when displaying upload fields in frontend and/or enabling this option.
General rules to protect your website
Perhaps this lengthy article has drawn your attention to the issue of your Joomla website security, and you would like to know more about this topic.
Joomla is considered one of the safest CMS ever. This is also reflected in the fact that there is a lot of good literature on this topic. But that alone is not enough. To keep your website secure, you must:
- understand the risks,
- observe the basic safety rules and
- act proactively.
The following websites have helped me a lot.
There is a very extensive and good German-language website that deals exclusively with questions about Joomla security: Joomla Security.
Especially the German article about protecting a Joomla website with htaccess is very interesting: htaccess settings in Joomla.
Of course there is also very good information on the subject in the English documentation: Joomla Security Guide.
Finally, I would like to draw your attention to the always very up-to-date list of known “vulnerable extensions”: Vulnerable Extensions.
At the bottom of this page you have the option of being included in an email distribution list. You will be informed immediately via this mailing list if it becomes known that a Joomla! extension got security holes. Of course, you will also be informed when gaps have been closed.
This information is very valuable. If hackers have found a bigger hole, you will receive a lot of emails in a short time. Otherwise, it is often very quiet for months. An interesting effect is that you can use the “solved” mails to see which extensions are intensively maintained and which are not.