Giving permissions to apache user

Question

I've developed a web application that lets the users to upload images and transform them to later download them again transformed. I obviously had to give apache user permissions to the directory where users can upload:

$ chown root:www-data uploadFolder
$ chmod 1775 uploadFolder

This, gives apache group all permissions, except removing.

The application creates a directory for each user session inside the uploadFolder directory with 0700 permissions, and saves the user's images inside.

The uploadFolder is inside the application directory.

When the image is uploaded, it is served directly (like a link) to the client.

A crontab job is executing a script every 20 minutes, that checks which sessions are active and removes all files and folders inside uploadFolder that doesn't match any active session.

It's working fine since two months ago, but I'm not sure if it could be dangerous for my application, database, or other sites in the same VPS.

Does anybody know the risk of being permissive in this situation?

Is there any alternative to avoid it?

This is my apache site configuration:

<VirtualHost *:80>
ServerName www.itransformer.es
ServerAlias itransformer.es *.itransformer.es
DocumentRoot /siteFolder
<Directory /var/www/itransformer-2.0/web>
   AllowOverride all
   Options -Indexes
</Directory>
</VirtualHost>

Added this snippet code to Apache site configuration: (this should avoid reading .htaccess files)

<Directory /uploadFolder>
   AllowOverride none
   Options -Indexes
</Directory>

Answer 1

You should first understand that security is a process, and you need to keep it in mind at all stages, and at all levels, of your development. Read and understand the OWASP Top 10 application security flaws and review your code with them in mind, both globally (your whole application) and locally (the individual parts of your application). Of course there are other security flaws so you should document yourself about it.

It is not possible to give good advice on this topic without any code and with only a very general and imprecise description as you are doing here. In your case I would especially watch for directory traversal, XSS, etc, but remember the risk can come from everywhere in your application.

In practice you probably want to run apache in a chroot jail, and I would also upload the folders with some randomly-generated names rather than the name provided by the users (it appears from the updates of your question that you are already doing that indeed). All in all, remember that will just make any flaw you may still have more difficult to exploit, but not prevent them altogether.