Plugin Directory

Changeset 515407

03/06/12 15:11:42 (6 years ago)

Added FAQ

1 edited


  • upload-scanner/trunk/readme.txt

    r514746 r515407  
    66Stable tag: 1.1 
    8 Scan all uploaded files with ClamAV 
     8Scan all uploaded files with ClamAV or your favorite malware scanner 
    1010== Description == 
    1212Scan uploaded files with ClamAV or run system commands against uploaded files.  This allows you to integrate third party malware scanners. 
     14This plugin __requires__ either ClamAV or another third-party scanner to be installed.  This plugin will pass uploaded files to the scanner and take appropriate actions based ont he results, but it is not, itself, a malware scanner. 
     16If you have a dedicated server, you can install [php-clamav](http://php-clamav.sourceforge.net) for performance and convenience. 
    1418== Screenshots == 
    4347= 1.0 = 
    4448 * Released 
     50== Frequently Asked Questions == 
     52= It says ClamAV isn't installed? = 
     54You'll need to install ClamAV and [php-clamav](http://php-clamav.sourceforge.net).  You don't actually need ClamAV to use this plugin, though.  You can use the system command to run another scanner that can accept input on the command line. 
     56For example, you could scan with avira like this: 
     60= It says exec is disabled = 
     62Your server admin has probably disabled the "exec" function.  You'll want to talk to your server admin before moving forward with this plugin.  They may be able to help, or they may have other security measures in place that mean you don't need this plugin. 
     64= Why doesn't this plugin offer a "delete file" option? = 
     66PHP automatically deletes the files for you if they're not handled. 
     68 "The file will be deleted from the temporary directory at the end of the request if it has not been moved away or renamed." 
     72= Are there any security issues running shell commands? = 
     74The only user input that is passed to the shell command is the original file name chosen by the user, and this is passed through escapeshellarg() to sanitize it.  Otherwise, the only command that's run is chosen by you.  It's left to your server admin (or you) to determine that it's safe for you to issue commands. This plugin _should_ prevent attacker input from making it into the command.  Let me know if you see any problems. 
     76= Is this compatible with Multisite? = 
     78I haven't tested this with Multisite yet.  If you have input, let me know. 
     80== Upgrade Notice == 
     82= 1.1 = 
     84First release on WordPress.org repository 
Note: See TracChangeset for help on using the changeset viewer.