Secure Serving of File Uploads on PHP Server without Root Config Possibilities? (Apache)

Question

To secure the file uploads to a PHP/Apache server, I have already implemented the following steps:

• Solid upload validation from PHP Framework
• Used own names for uploaded files
• Place uploaded files in server directory outside + above web root level
• disabled PHP interpreter module for concerned directory
• disabled execution rights on upload directory
• always deliver 'Content-Type' header when serving files from it to client, e.g. image/png if .png file is served

The problem I have now is that I have no root access, so I don't know how I should implement the actual GET requests for clients to be able to view uploaded files.

My hosts recommended me to add an Apache rewrite rule to a PHP script that in the end will serve the according image file with the proper Content-Type header via PHP process, yet this seems risky to me. It also brings the risk that users may upload PHP files that get misinterpreted as image files, which may get executed when processed via PHP, or is this assumption incorrect?

They cannot implement the root-level Alias for me. Isn't there a better way to serve uploaded files from a directory outside of the root, as above, without involving PHP?

Answer 1

You don't need root access for any of that.

If you are using PHP, you can use move_uploaded_file to send the file you receive from the client to any directory you have access, including somewhere outside the WebRoot. Disabling PHP on this directory isn't needed. It's outside the WebRoot, so it's not accessible from any client.

Sending the correct Mime Type does not depend on root either. Use header('Content-type: image/png') and PHP will set the proper HTTP header. To send the file data, use readfile. It will just send all file data to the client, without any filtering or processing, so even if the file is a PHP script, it will be sent AS IS to the client, and not interpreted on the server in any way.

I would not save the file with the same name the client sent it, but generate a new name server-side. This helps avoid files being overwritten, filenames being bruteforced, things like that.