Allowing Users To Upload ANY File. Is My Method Insecure?
<p>I'm creating a file sharing site, similar to Megaupload or Rapidshare. Just like those sites mentioned I need to allow ANY filetype.</p>

<p>I was thinking about a solution, and need to know if there is any security risks with it, or is there a better solution to my problem?</p>

<ol>
<li>User uploads file</li>
<li>Check file size, if below 100mb begin upload</li>
<li>Encrypt the filename using IP, timestamp and salt</li>
<li>Store in a directory that is not accessible from the web</li>
<li>Store filename, description, and hashed file name in database</li>
</ol>

<p>Upload done. Now for the downloading:</p>

<ol>
<li>User requests download</li>
<li>Connect to database, locate file ID</li>
<li>If file ID found, copy the file from the file server location and prepare for file transfer</li>
</ol>

<p>It's important to note that <strong>NOTHING CAN EVER RUN ON THE SERVER</strong>. So users can't upload malicious files and launch attacks on the server. When requesting the file, it will immediately launch a download, and never run.</p>

<p>Now, with the above in mind, is there any flaws in the model above that could allow malicious users to attack the servers? </p>

<p>For the purpose of answering the question, assume the rest of the site is secure.</p>
