As designed user can upload the video when added extension to attachment without permission

[hemant_bhardwaj]

Affected version

2.1.3

while enabling the video upload in xenforo i added the video extension in the bottom of the image extension

but i didn't give user permission to upload video

still users can upload the video

 

[Martok]

Use Analyse Permissions in the ACP (both Global and Node Permissions) to check to see if the user has gained the permission from another user group/ user permission.

Also as per our previous discussion you don't need to add some of those video extensions there, they are enabled automatically when you enable video uploads in Attachments in the ACP.

 

[Liam W]

You need to remove the video file extensions from the option, they're applied if the user has permission to upload videos. By adding them to the option, you're allowing all users to upload videos.

 

[Chris D]

You do not need to add the video extensions to the allowed extensions list because the relevant extensions we support are added automatically if video uploads are enabled.

However, if you do add them, you're implicitly enabling and allowing video uploads so if you want it option based / permission based, you just need to remove those extensions.

 

[Chris D]

Yeah what Liam said

 

[ShinLim]

Yeah what Liam said

Hi @Chris D and @Liam W
I accidentally bumped into this thread
If I enable more extension like hemant_bhardwaj, can someone hack xenforo or exploit by upload shell fake extension like this ?

 

[Chris D]

No. This would be a very serious exploit. A combination of measures within XF and the way most web servers work by default protect against this.