Hi,

I can add a file upload to a webform. The submission of the form is only available to submitters and admins. However, if the form includes a file upload, this file upload is accessible to everyone able to guess the URL. This is very strange behaviour, because I have configured in Drupal to have "private" download method (under Site configuration -> File system).

Is there any way to prevent this public access to uploaded files? Do I need another module for that purpose? Can I create a custom field?

Regards,

Sebastian

Comments

vm’s picture

vm commented

I don't know how webform handles files but when it comes to core, just switching drupal to the private file system does not make your files private in the way you want. You must put the files folder above the public root where it is not accessible to the public by browser.

switching to the private file system without moving the files folder above the public root, only alters the URL to teh files by adding /system/ to the path. Therefore if the files folder is still accessible in the public root, then then users familiar with the way drupal handles these files can still get to them.

advseb’s picture

advseb commented
Category: support » bug

I did some debugging. It appears that the problem is related to a regression with fckeditor module. Both modules implement the _file_download() hook. Webform correctly denies access to the image file if the accessing user doesn't has the "access webform results" permission. It could be discussed if access to uploaded files should not be given to the uploading user as well, but that is another issue.

The problem is the implementation of fckeditor_file_download() in fckeditor.module. The relevant code snippset breaking security is:

//it is probably file uploaded with FCKeditor
if ($path = file_create_path($file)) {
$ctype = ($info = @getimagesize($path)) ? $info['mime'] : (function_exists('mime_content_type') ? mime_content_type($path) : 'application/x-download');
return array('Content-type: '. $ctype);
}

This statement evaluates to true and therefore access is granted. For me, that is an obvious security problem. However, at the moment I'm not really sure if it is webform's or fckeditor's fault.

How is such an issue handled correctly??? Should I also open a request at fckeditor project?

wwalc’s picture

wwalc commented
Status: Active » Closed (fixed)

I think it can be closed because it turned out that it is a problem with the wrong implementation of the hook_file_download() hook in the FCKeditor module.

advseb’s picture

advseb commented

Yes, it can be closed, even though I'm a little bit woried that I don't really get feedback from fckeditor's team nor the security team...

vm’s picture

vm commented

more than likely you won't hear back from the security team of drupal core over this issue. If that is the security team you are referring to.

Not because they don't care but because this isn't a bonafied "security" issue where the security team would get involved. The security team handles XSS exploits and the like.

wwalc’s picture

wwalc commented

@advseb - I'm the maintainer of the FCKeditor module, I have replied to your message here: #347865: Fckeditor module breaking security of webform module (waiting for your comment) and I'm the guy that have sent you an email few days ago (yes, that's again me), so I'm not sure why you're saying you got no feedback from the FCKeditor's team ;)

advseb’s picture

advseb commented

@wwalc: I'm sorry, I mixed up who you are :-)