Hi, Alex.
To be honest, I'm still learning myself. Putting the password access issue aside for a moment, some basic things you could do is create an htaccess file in the uploads folder and prevent index listing and script execution:
As well as preventing unauthorised script execution, staff members would now have to know the the image file name in order to view any of the said pictures uploaded to this directory.
Furthermore, since you're only allowing pictures to be uploaded, you can restrict other files as follows:
Also, try assigning the uploads directory 775 permissions instead of 777.
The best solution is to see if you can move the uploads directory outside of the WWW root (depends largely on webhost and setup).
Everything else you've described in terms of set-up sounds fine; Formtools provides a lot of the logic and necessary helper functions for dealing with uploads.
It's always a trade-off between security and accessibility but the above tips should help provide you with a good baseline.
To be honest, I'm still learning myself. Putting the password access issue aside for a moment, some basic things you could do is create an htaccess file in the uploads folder and prevent index listing and script execution:
Code:
Options -Indexes
AddHandler cgi-script .php .phtml .pl .py .jsp .asp .htm .shtml .sh .cgiAs well as preventing unauthorised script execution, staff members would now have to know the the image file name in order to view any of the said pictures uploaded to this directory.
Furthermore, since you're only allowing pictures to be uploaded, you can restrict other files as follows:
Code:
<Files ^(*.jpeg|*.jpg|*.png|*.gif|*.png)>
order deny,allow
deny from all
</Files>Also, try assigning the uploads directory 775 permissions instead of 777.
The best solution is to see if you can move the uploads directory outside of the WWW root (depends largely on webhost and setup).
Everything else you've described in terms of set-up sounds fine; Formtools provides a lot of the logic and necessary helper functions for dealing with uploads.
It's always a trade-off between security and accessibility but the above tips should help provide you with a good baseline.