Custom Fields for File Uploads

Hi all

We use Events Booking custom File fields for applicants to upload supporting documents if needed (not very often at all). Once our staff have sighted/verified the documents, we have no ongoing requirement to retain the uploaded physical files. After the recent hardening of the file upload fields for all JoomDonation extensions I am questioning whether I should consider another approach and request proof externally of our website for a number of advantages.

But I know how good JoomDonation is at keeping us up-to-date and safe as possible and getting uploads at registration is usually the best chance we have for them.

What do you suggest about the best approach going forward and also I have realised I should perform some general housekeeping on my server space to clean up files more often.

Would implementing your Orphan File check tool and the recent hardening you introduced cover everything or is the best approach just stop using file upload fields all together?

and could you let me know if I can simply delete the existing uploaded files I have at the same time using FTP or will that create any broken issues in registration records through the website backend dashboards?

I really want to follow best practice advice but to delete the uploaded files we get more often and more regularly without wrecking anything through me now understanding.Our directory now contains several years of historical uploads.Can you please confirm:

1. Is
   Code:

   "/media/com_eventbooking/files/"
   the standard storage location for files uploaded through Events Booking custom File fields?
2. Once a registration has been processed, is it safe to manually delete the physical uploaded files from this directory without affecting the registration record or other Events Booking functionality?
3. Does Events Booking store the filename/path in the database, and is there any problem with leaving that reference in the database after the physical file has been deleted?
4. Is there a recommended method within Events Booking for purging old custom-field uploaded files rather than deleting them directly from the filesystem?
5. Are there any files in
   Code:

   "/media/com_eventbooking/files/"
   that Events Booking itself requires and that should not be deleted (for example
   Code:

   index.html
   )?

We are running the latest Events Booking version.
I am also running latest versions of Membership Pro and EShop - can I do the same thing for those extensions or should I put a different post in each forum?

Thanks as always

Chris

Hi Chris

You do not need to worry much about this. In the worse situation, attackers can just upload files to that folder and it will take some hosting space. But there is no reasons for them to do that unless someone just does that for fun

- The uploaded files are protected by .htaccess, so it could not be direct accessible
- The uploaded filename is randomize, so they cannot guess the name of upload files

So there is no good reasons for them to upload files. You can continue using it as how it is. If you worry about these orphan files, setup scheduled task docs.joomdonation.com/eventsbooking/sche.../delete-orphan-files to delete orphan files

You can also delete the files for old registration records if you want. It won't cause any error, just the file won't be accessible anymore when you access to these registration records

Regards,

Tuan

In short, you do not need to worry much about this. There is no good reasons for this kind of attack, attackers get nothing if they do the attack. Even if they just perform attack for fun, the scheduled task will just clean these files automatically. Nothing is broken, no data is lost... for this.

Regards,

Tuan