13. ALLOWING USERS TO UPLOAD FILES TO YOUR WEB SITE

A secure way to allow others to upload small files to your account (less than 1MB) is via HTTP through the use of an upload cgi script. We've modified the upload script and example HTML form from Jeff's Script Archive for our system. They are available at URL:

http://clearlight.com/pub/upload

Edit the FORM tag in HTML upload form upload.html by replacing YOUR_USERNAME_HERE with your own account user name. Edit the CGI script file-upload.cgi and change (at miniumum) the SAVE_DIRECTORY setting to show the path to your upload directory.

For security reasons we recommend that you configure file upload capability only for approved users:

1) Change the file name of the script file-upload.cgi to something unique.

2) Password-protect the HTML form that activates the file-upload.cgi script by placing it in its own subdirectory protected by an .htaccess file. Please see the user's guide LIMITING USER ACCESS TO A WEB DIRECTORY.

3) Configure the upload location to be a separate subdirectory which holds only uploaded files. The upload directory should not be the one that holds the HTML upload form or other regular web site files.