I wonder if we have a form allowing file uploads for front end users, does Craft or its plugins have certain feature to scan for virus / malicious content, before saving it? If not, what would be the best practice to handle front-end users' uploads? E.g. shall it be handled by the hosting server, or is there a 3rd party library / service that can help?
1 Answer
Craft will do some minimal cleansing of potentially malicious uploaded images by default by saving them back out to the file system and will try to sanitize SVG files as well.
It also has a relatively tame list of file extensions it allows on upload: https://docs.craftcms.com/v3/config/config-settings.html#allowedfileextensions
Anything outside of that, it'd be up to a Craft plugin or something on the server-side to do additional analysis and cleansing.
answered Sep 23, 2019 at 19:12
