File / Image upload exploit??

Hi,

I'm curious as to why the following HTML page can be accessed by anyone, on a site that I have CKFinder installed on:

/sitepath/ckfinder/ckfinder.html

From here anyone can upload files to my server. Isn't this a HUGE security hole? Have I missed a config option in CKFinder which prevents this?

Sat, 11/16/2013 - 08:12

synchro

Joined: 10/12/2007

Posts: 64

Check the CheckAuthentication

Check the CheckAuthentication function. As it clearly says in the config file:

	// WARNING : DO NOT simply return "true". By doing so, you are allowing
	// "anyone" to upload and list the files in your server. You must implement
	// some kind of session validation here. Even something very simple as...

	// return isset($_SESSION['IsAuthorized']) && $_SESSION['IsAuthorized'];

	// ... where $_SESSION['IsAuthorized'] is set to "true" as soon as the
	// user logs in your system. To be able to use session variables don't
	// forget to add session_start() at the top of this file.

This is for PHP, but other languages will do something similar.