Security-Holes in Attachments

Not so much a security hole, just something that you have to accept when using ASP.

If you upload something to a publicly accessible server you just have to accept that it is just that, 'publicly accessible'.

The only way to prevent this is to place a password on the directory the file is uploaded to.

As most people don't have access to the server they can not do this, and even if they can unless they have access to the server, or components installed the forums permissions wouldn't be able to grant them access to that folder.

If you do as you suggest and place the attachments in the database, this would be a huge performance hit, especially if using Access as the database size would become very large and full of attachements.

As far as the attachment not deleting when you hit cancel, this again can not be overcome with ASP alone and is more to do with the upload component and the way in which the stateless HTTP protocol works.

The attachment and image upload feature is only there as people requested it, but I would recommend NOT to use if security is a priority as it does mean you have to set write permissions etc. on the folder where the files are uploaded, as well as a number of other security issues.

@-boRg-:
You missunderstood....I didn't want to put the attachments INSIDE the database, I only want put a "reference" to the real path+filename to the file and give the downloading user an ID, which is handled by a download.asp-script, streaming the file as "filename.ext" without the path where it cames from. This would give me the feature to store the files in an area, where a "normal" user never would gain access to (as proposed by Gullanian) over the web.
This would also give the forum the possibility to check the permissions for downloading this file (tlbAttachmend holds Att_ID, Thread_ID and the RealPathToFile) by Thread_ID.
The link would show like href="download.asp?ATID=4" which then checks the permissions for the Thread_ID stored in conjunction with this attachment.

My only problem is about the "garbaged files" when cancelling a posting after uploading.