A Flash Custom Upload Feature, Your Thoughts on it?

[thegim]

Since this is not a dev, tutorial, and i don't need help.. and i am not releasing anything..
Why not post my opinion here....


Ok First many of you may remember the CCT Uploader From Flex hotel...

Well why has no one created a swf uploader?
Honestly...

Its not to hard.. the hardest bit is creating the query via form... but that's not even that hard....
Also put a download link to a swf decom.. if you need one i have a link to a swf decomplier you can download to create swfs..

I can make everything for it but the query's
So what are your thoughts
If someone made a SWF Uploader for there hotel would you use it
would you like it... ???

[MentaL]

[Wreckless]

Since this is not a dev, tutorial, and i don't need help.. and i am not releasing anything..
Why not post my opinion here....


Ok First many of you may remember the CCT Uploader From Flex hotel...

Well why has no one created a swf uploader?
Honestly...

Its not to hard.. the hardest bit is creating the query via form... but that's not even that hard....
Also put a download link to a swf decom.. if you need one i have a link to a swf decomplier you can download to create swfs..

I can make everything for it but the query's
So what are your thoughts
If someone made a SWF Uploader for there hotel would you use it
would you like it... ???

I've seen it done before, but it's not very secure at all. It's like going to prison and taking your pants off.

[The General]

People are going to exploit it and most players dont even know what the f flash files are and how they work. You should give them your email adres if they say "Hey I have cool furniture here could you add it?". Maybe thats better instead of making a insecure upload tool. I can tell you if you made it 100% secure it wont be used by people on your hotel.

[Clawed]

This can easily be done, but like other's said, the security of it is a problem.

[Caustik]

Sandboxing the file would work. Then it would be secure.

[thegim]

only allow .swf , .SWF only allow a certain sized file, o and if to many is uploaded by a user at once he will be like umm banned or something for 10mins

so people can't send rubbish

[Mithex]

only allow .swf , .SWF only allow a certain sized file, o and if to many is uploaded by a user at once he will be like umm banned or something for 10mins

so people can't send rubbish

Honestly, adding a simple 60 character line into the SWF and saving it can be an exploit. Do you not remember the Joopie/PEjump2 scandal? They exploited one of the gift wrapping SWFs by adding in a simple line and just destroyed hotels. If you wanted to do this you would need to make a script that reads the HEX of the SWF and makes sure it is the EXACT same, except for the names, as a few models.

For example, if you take the throne SWF. You basically would have to create a script that would make sure everything in the new SWF is the same as the throne SWF except for the name throne changing.

IMHO its way to easy to exploit.

[thegim]

so the .swf it self causes the exploit or the query or the furnidata what is the exploit causeOR lol... because if the swf is the problem
ill let the user upload all other data and ill process the swf"?

[AWA]

I don't think every browser would auto-run flash if it were that insecure..