Attachment folder & security

[Golzarion]

attachments out of database & ch mode777 security?

hi there

I decided to move the attachments out of the database for some reasons ....

But as far as I know I have to disable php Safe mode. and also I have to set folder's change mode to 777.

Aren't these dangerous ? or risky ?

how can we secure folder ch mode 777 ?

how can we have this folder upper above root ? or secure it by using htaccess file?

[Floris]

Yes, there's a slight security issue with this, chmod 777 is not recommended. However, you could place a htaccess file inside this directory I believe, and you can also move the directory outside of the public_html/ directory.

/.
/..
/attachments
/public_html
/tmp

[Golzarion]

I moved the attachment folder (with ch mode 777) outside of the public_html/ directory.

Is that enough ?

what code should I put in htaccess file? the codes just not allow anybody to upload and execute php or html files ?

Can I be sure that by moving attachments outside of the public_html/ directory there would be no security issue ?

[Floris]

When it's outside the public_html dir you don't need .htaccess.

[Golzarion]

When it's outside the public_html dir you don't need .htaccess.

I 'm not sure just move it outside the public_html is enough for security of attachment folder !

at least when I use shared server there can be a security issue ? is it right?

Isn't it better not to move that folder outside public_html but protect it by .htaccess?
Would you please helping about .htaccess codes?

I don't know what should I consider about .htaccess codes and security matters.

Thank you .

[Floris]

everything inside public_html/* is what you can see from a browser
everything outside it.. you can't. So it's secure.

[kentaurus]

.htaccess suggested contents

deny from all

that should be enough it's better to move it off the public_html, tough

[Golzarion]

everything inside public_html/* is what you can see from a browser
everything outside it.. you can't. So it's secure.

Thank you any way!

.htaccess suggested contents
Originally Posted by .htaccess
deny from all
that should be enough it's better to move it off the public_html, tough

Exactly that is the best way ! but there is only two problems ! when I used the code :

" deny from all" no body could see images that has been attached !!!

I believe that is the best way... except for showing attached images .

and about the second problem ..... let's talk after the first solved...

[Golzarion]

Finally I found the solution !

but it is strange that nobody here mentioned it ! I think there are many who know but they do not want describe .. in order to hide security of their own forums....

anyway It's solved.