forum.coppermine-gallery.net

No Support => General discussion (no support!) => Topic started by: jodest3 on July 07, 2006, 10:39:45 pm

Title: Is Security tight with coppermine?
Post by: jodest3 on July 07, 2006, 10:39:45 pm

Hi there!

I want to upload files via the web to either Coppermine (which is why I'm here) or some other place that keeps files only for registered users (ie. only me) and keeps them locked from anybody else getting in.  I'm not sure how Coppermine is secure.  I've heard some things in the past about this gallery being hacked.  I don't want that and I'm really quite scared.  So I thought I would ask you guys. 

Is Coppermine good for this?  Is there a particular version I should be installing?  If Coppermine isn't good for this, do you recommend doing anything else?  Any other programs or tricks?

Thanks in advance!

 - Jess

Title: Re: Is Security tight with coppermine?
Post by: Nibbler on July 07, 2006, 10:43:14 pm

Coppermine's raison d'etre is to display images, not to protect them. If you want to hide them then password protect the Coppermine directory at the server level and you're safe. Only version we recommend is the latest stable version, 1.4.8.

Title: Re: Is Security tight with coppermine?
Post by: jodest3 on July 08, 2006, 05:54:23 am

Oh I know that ;)  I know to password protect, but what I'm wondering is - can someone hack through that?  Through password protecting - is security pretty tight?

Title: Re: Is Security tight with coppermine?
Post by: Tarique Sani on July 08, 2006, 06:31:01 am

Anyone who knows the complete URL to the files/pictures will still be able to get to them as they are still stored in the webroot - in short the album pages are protected the pictures themselves  are not - this incidentally is similar to flickr

Title: Re: Is Security tight with coppermine?
Post by: Joachim Müller on July 08, 2006, 10:46:29 am

If you are going to be the only person to access your gallery, apply an authorization method on webserver level (i.e. password protection using .htaccess methods). This way, everything within the coppermine directory can be kept from being accessed unless a potential attacker manages to hack your .htaccess password auth. However, this discussion applies to everything that is password-protected.