Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using Restlet as backend trying to create a small web app.

I am allowing users to upload their profile images, but not sure where to store them. Google tells me to store it in the file system and store the image path in DB which make sense.

So should I store them in a public web folder in which the web front end lives? But wouldn't that allow people to access all the profile images very easily?

If i don't store the images in the public web directory, where should I store them and how do I protect them?

My server is Ubuntu server 12.04 thanks in advance

BTW any advice on how should I process the images upon upload? I'm trying to convert all formats to png and resize it

share|improve this question

closed as off topic by random Mar 28 '13 at 16:08

Questions on Super User are expected to relate to computer software or computer hardware within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 2 down vote accepted
  1. Check every image, if you use PHP, you can call getimagesize()
  2. You can save images inside www, but, you can disable directory indexing, or,
  3. Save images outside www, then, you need to read the images internally by like reading file.
  4. It's better also to disable PHP on the directory where the images stored.
  5. I would also prefer to check the image when loading it using getimagesize(), I am sure if you use image libraries, you can detect invalid image types in case when malicious code injected.
share|improve this answer
Restlet is for Java, nothing mentioned PHP... #2 sounds a good option, if the filenames are generated randomly. – grawity Mar 28 '13 at 15:35
Great, thanks a lot. Well Restlet is a Java web API framework but php examples does provide some insights. I think I'll just store the images inside www folder and disable folder browsing, generate a random image name for each id and store it in DB – Matthew Yang Mar 28 '13 at 19:20

Not the answer you're looking for? Browse other questions tagged .