Hi all,
We have two reasons for not limiting uploads to a certain type in order to avoid this kind of attack:
- If your files directory is publicly accessible, then it’s not just executables that you need to worry about – your submission files can be downloaded by anyone who can guess the URLs, potentially exposing unpublished research.
- Using a block-list approach (whereby we list types of files that should not be allowed), it’s impossible to know what your server might potentially execute. Using a permit-list approach (whereby we list types of files that should be allowed), we drastically limit submission types that might well be valid. And some of the “risky” (executable) types do have legitimate uses in a journal, especially as publications start to include code e.g. for statistical analysis even outside technical fields.
Moving your files directory outside the public_html directory will solve both problems – legitimate scholars and would-be hackers alike are free to upload .phtml files (etc)., but they pose no risk if they are malicious.
Regards,
Alec Smecher
Public Knowledge Project Team