Hi,
I have purchased easy profile on 21/12/2013 and implemented successfully, only problem is, it allows authenticated users to upload malicious files in the function “Profile Picture” and "Cover Pircture". There is no check on the file content type being uploaded. For instance,
It was possible to upload a HTML file with malicious script, which can be used as a Stored XSS.
So how to restrict the image upload to image types only
Regards
Support
- Page :
- 1
There are no replies made for this post yet.
However, you are not allowed to reply to this post.
However, you are not allowed to reply to this post.
Request Support
Support is currently Offline
Support Availability
Working days: Monday to Friday. The support staff is not available on weekends; in the most of cases tickets will not be answered during that time.
Reply time: Depending on the complexity of your support issue it's usually between a few minutes and 24 hours for paid members and about one week for free members. When we expect longer delays we will notify you.
Guidelines
Before you post: read the documentation and search the forums for an answer to your question.
When you post: include Site Details if you request a support (you can use the form below the reply in Site Details tab).
Auto Solved Question: If after a week the author of the post does not reply to a request by moderator, the question will be marked as resolved.
Language: only English
Search Users
Easy Profile® is not affiliated with or endorsed by Open Source Matters or the Joomla Project. Joomla is Free Software released under the GNU/GPL License.