Allow upload of image files to hosted locations for skinning purposes

[Jamie Edwards]

Originally Posted by craigbrass

I am not saying you give any indication, I am just saying I think you should offer it. It should only allow PNG, GIF and JPG for the purpose of skinning your help desk. There are no security risks then.

[supportskins]

I second this. You can create a directory called skin and allow users to upload files in this directory.

[bear]

No security risks? A PHP file doesn't have to be named PHP to be run...
If you allow this, make sure you also disable PHP and PERL (etc.) parsing in that directory by default. Something like this in an .htaccess file, perhaps (may not work on all server configs):

php_flag engine off

Probably a more elegant and effective way would be to set flags on the directory in the server's httpd.conf file.

[Timetabler]

As a new 'hosted' user it seems odd to me that:
--you allow me to easily change the text that is displayed, and you store that new text for me,
--you allow me to provide 'download' files, and store them for me,
--you allow me to change icons, BUT you do not store the new images for me, ...so most of the display is coming from your server and the rest is coming from an entirely different server elsewhere in the universe.
I don't have a slow dial-up but I wonder whether this arrangement makes the site look lazy?