hi, i am using fancyupload(combination of flash upload(file reference) and javascript)… the problem with file reference is that it doesn’t send cookies and sessions to the upload script but i need to do authentication in the upload script to prevent any illegal uploads…
i read that session id must be sent to the upload script… but i wanna know if it is a security issue to send session id explicitly like this…
the fancy upload operates by giving the url through the javascript so basically i need to append the session id to the url making visible to the public… so is there any harm that can be made if this session id is seen by everybody… i read somewhere that this can be a risk for CSRF(cross site request forgery)??
is there a more secure method to do it??
and another question this how i wanted to do my upload
- load my php page where the upload form is found… (i create a $_SESSION[‘upload_allowed’]
- then i append the session id to the url of the upload script (e.g. “/includes/upload.php?PHPSSID=”.session_id()
- when a user uploads a file…the flash uploads the file and calls the script upload.php?PHPSSID=1231231313
- the upload.php checks if $_SESSION[‘upload_allowed’] is found and allows the copy the file if it is found…
i wanna know something… i create a session $_SESSION[‘upload_allowed’]… the flash uploads a big file(say it takes 1hr)… and after the upload is complete, it calls upload.php… but what if the session lifetime is less than 1hr… the upload will fails isn’t it??
when does the flash actually calls upload.php, when upload is complete(to temporary file) or at the start of upload??? i am confused with this
srry for such a long history…
