To secure the file uploads to a PHP/Apache server, I have already implemented the following steps:
- Solid upload validation from PHP Framework
- Used own names for uploaded files
- Place uploaded files in server directory outside + above web root level
- disabled PHP interpreter module for concerned directory
- disabled execution rights on upload directory
- always deliver 'Content-Type' header when serving files from it to client, e.g.
.pngfile is served
The problem I have now is that I have no root access, so I don't know how I should implement the actual
GET requests for clients to be able to view uploaded files.
My hosts recommended me to add an Apache rewrite rule to a PHP script that in the end will serve the according image file with the proper
Content-Type header via PHP process, yet this seems risky to me. It also brings the risk that users may upload PHP files that get misinterpreted as image files, which may get executed when processed via PHP, or is this assumption incorrect?
They cannot implement the root-level
Alias for me. Isn't there a better way to serve uploaded files from a directory outside of the root, as above, without involving PHP?