Hi,
In tds-my-account/?account_details the user can upload a Profile picture.
The image is uploaded to Media Library.
1. Is there a way to prevent a large file upload, eg set max file size?
2. What type of files does it accept (jpg, gif, png..?)
3. What if a file contains virus, malware? Is there a defense against it on upload?
Hi,
There are some image formats set – https://i.imgur.com/IciqcoF.png
and for the moment there is no restriction set for the size of the image, it is desired to use the general option that is set on the server.
Thank you!
Hi,
Thank you for your response.
Is it possible to disable Profile Picture upload by the user?
Hi,
Unfortunately, for the moment this can be done only with custom css:
.tds-s-form-content .tdb_form_file_upload {
display: none;
}
This code needs to be set in the theme panel > custom code> custom css.
Thank you!
Hi,
The css only hides the element, as it still, in fact, exists.
So it appears that anyone can unhide it (via dev tools), and start uploading a large quantity of image files, which can potentially harm/overload the website (CPU, etc), especially if a few users do this (or bots).
Isn’t it a security issue?
Hi Alex,
The CSS is one solution, another solution is to comment/delete the respective code from the theme.
But in that area only a user who is logged in can access the upload element, once again there are some restrictions set for that upload element and type, but I think it is unlikely that a user will continuously change his image and upload only big pictures.
Anyway, as I mentioned, a developer will check to be sure that this is not a vulnerability.
Thank you!
Hi Calin,
I believe it is a serious venerability.
In today’s day and age, when literally everything gets hacked – On a big website with a lot of traffic, there will definitely be someone, who would try to break it/hack it.
1. Re: It is unlikely that a user will continuously change his image and upload only big pictures.
So, “unlikely” is not really a long term commercial solution. It should be certain that it is impossible to do what is described.
2. Re: That area only a user who is logged in can access the upload element
As we discussed with you here, anyone with “fake/not verified email” can do it.
Thank you.
Hi,
Yes, as we discussed in the previous email, these suggestions are on the element improvement list and the next update should introduce them.
Thank you!
