Uploading Images via The Comments section WP.

I think I know the answer, but I just want to double check with you guys.

If I allow people to upload images to the comments section of my website, am Leaving it wide open for an attack?

Cheers,

James

Im not going to say yes. But i hate the way wp comments are so i use disqus plugin. Honestly most of my users use that app i dunno why but im also starting to see it implemented around other blogs.

headspace said:

Im not going to say yes. But i hate the way wp comments are so i use disqus plugin. Honestly most of my users use that app i dunno why but im also starting to see it implemented around other blogs.

Click to expand...

Thanks headspace. I'll check it out.

Not necessarily an attack, but your hdd space on your server or hosting account will surely suffer if you enable that feature

Hope you have a strong hosting plan.

Allowing users to upload images revoked lol. I'll let Discus's servers hold it for me. Cheers headspace.

Yes and No. If you validate the upload properly, and have a hosting plan that isn't vulnerable you will be safe. When I say validate, I mean client side validation plus server side extension validation plus byte validation ( read a few byte and decide if a real image). Also disable server side script execution in the folder where you upload images. For bullet-proof security, use php to convert the file to image ( imagecreatefrompng etc) as you do not want to trust user input. In-fact, I would look for other ways of storing the image ( like as blob in db, or don't save the image inside your http docs.. etc ) too if I was too paranoid.