1

So I'm trying to solve how to block users from downloading an attachment of a timed WordPress -post before article goes live? Attachments work as uploads on a custom field in an article.

My current solution is to use htaccess to block the uploads archive, so visitors cannot browse them and thus see a new file before its released. Also if the client gives a hard-to-guess names to the attachments then users will not be able to get to them without knowing the exact name (right?)

.htaccess:

Options -Indexes

My questions:

  1. On a scale of 1-10, how easy my current solution is to hack? Is it possible to make this solution relatively safe

  2. Is there another safer solution for this? could a plugin be developed to transfer the file from a safe place when article gets released

  3. Can ANY solution where the attachment is on the server/inside WordPress -uploads be a safe solution?

  4. Is there a third party solution for this? Like service that could release documents at specific time

Thank you very much in advance

1

If all you have is

Options -Indexes

in your htaccess file, then it is trivial to 'hack' in and find your 'safe' file.

All that does it protect against people browsing through your site. Similar to youtube's option for 'not listed' video urls. I can still find the links and once I do, there is no security.

The better solution would be to toss a

Deny From All Allow From [your ip] (if you need to access it remotely)

in your htaccess file. This will explicitly deny all access.

  • Thanks! But how can you find a link to the file? Out of curiosity – Ketri Sep 2 '14 at 18:05
  • The attacker can simply look at existing links and 'tweak' them. For instance, with site.com/wp/page1 (published) and site.com/wp/page2 (unpublished), the attacker can infer that there may be a page2. This is oversimplified, but you get the point. In actuality, this is all done automatically with scripts... – Matthew Peters Sep 2 '14 at 18:31
1

Your solution:

Options -Indexes

It blocks the directory listing of files. The only way a user could find the attachment is if exact name of the attachment is known. This could be attacked using the following ways:

  • The Attacker uses a Directory exploring script or tool like Directory Buster. These tools contains dictionaries of millions of words, which are then bruteforced at rapid speed. If the attachment name matches with the word it will be displayed.
  • A pattern could be formed about the name of the attachment if the user observes the name of previous attachments, hence creating a custom wordlist to bruteforce.

On a scale of 1-10, how easy my current solution is to hack? Is it possible to make this solution relatively safe

Ans) It depends on the complexity of the names of the attachment.

Is there another safer solution for this? could a plugin be developed to transfer the file from a safe place when article gets released

Ans) Yes, a plugin can be developed, using cron jobs and wordpress development.

Can ANY solution where the attachment is on the server/inside WordPress -uploads be a safe solution?

Ans) This solution works , you just need to make your attachment file names a little complex. Means that avoid dictionary words, use special Symbols (" £ $ % ^ & * ( )<>?:@~}{) etc.

Is there a third party solution for this? Like service that could release documents at specific time

Ans) I don't think there is any, and there is no need to waste money on such services, as described above, if you follow this. hopefully it will work for you.

  • Interesting. Thank you. It seems people are very divided between this being a safe solution IF the filename is indeed hard to guess (think 1Xz)AmkEZ}W~jtG.pdf)and saying it's very unsafe. – Ketri Sep 2 '14 at 18:10
  • Security through obfuscation is not true security.... – Matthew Peters Sep 2 '14 at 18:32
  • @Ketri , As i said its safe , just increase the complexity. – Haider Qureshi Sep 2 '14 at 18:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.