Severe security risk with OJS?

[andrecolbert]

I searched the forum before posting a new topic on this issue, but the search resulted in zero. I find it very odd that no-one has posted a question or comment about such a basic security issue.

My concern is that when an author uploads a submission, there seems to be no restrictions on file types or the ability for OJS to implement a third party virus scan. If this is the case, what settings are available to scan submissions before they are uploaded?

On the surface, OJS looks like it exposes OJS installations to malicious script and/or virus files disguised as submissions. I say this because I discovered a submission posted to our journal that was not a DOC file but a PHP file. I immediately rejected and archived the file. But If a journal has many editors who are not tech savvy, one of them may accidentally open a bogus submission and trigger moderate to severe harm to their OJS installation, their computer and even their network, depending on the contents of the file.

[asmecher]

Hi andrecolbert,

There is no internal virus scan, but one could be implemented as a plugin or using a server-side virus scanner without any OJS integration being needed. To prevent server-side execution, the files_dir should always be configured outside of the web server's root directory (see recommended configuration in docs/README); that way file access is always mediated by PHP rather than allowing potential access directly via the web server.

Regards,
Alec Smecher
Public Knowledge Project Team