Quarantine of Iptanus File Upload Plugin

The Iptanus File Upload plugin gained a quarantine in version 4.25.0. It is a holding area for uploads that the plugin would otherwise reject outright, so that you can look at them yourself before they are lost.

The quarantine is a folder that is not publicly reachable. Files sit there temporarily while an administrator decides what to do with them: accepted files are moved on to the location they were bound for, and rejected files are deleted.

A file is quarantined when the plugin cannot validate its MIME type. Quarantined files are kept for thirty days by default, after which the plugin deletes them.

Alongside the quarantine come upload exceptions — rules that tell the plugin to accept, automatically and from then on, files it would normally turn away.

Switching it on

The quarantine is off by default. To switch it on, go to Dashboard → Settings → Iptanus File Upload → Settings, find Quarantine Settings, and tick Quarantine Active.

A new Quarantine tab then appears in the plugin’s Dashboard area, where quarantined files are reviewed and managed.

The quarantine folder

When you switch the quarantine on, the plugin creates the folder under /wp-content and sets its permissions to 0750, which keeps it out of public reach.

Its default name is /wfu-quarantine. You can change that with the Quarantine Folder option in the plugin’s Settings:

Give it a different name and the plugin creates the new folder and sets its permissions in the same way.

What gets quarantined

Every upload is checked against its MIME type — the label that says what kind of file it is and how it is formatted.

The MIME type has to agree with the file’s extension: an image named with a .png extension must have a MIME type of image/png. The plugin holds a standard list of which extensions go with which MIME types, and a combination that is not on that list is treated as suspicious. Without the quarantine, the upload is rejected and the visitor sees this:

With the quarantine switched on, the file is held rather than rejected, and the message changes:

Reviewing quarantined files

Held files are listed under the Quarantine tab in the plugin’s Dashboard area:

For each file the table shows where it was headed, how big it is, when it was uploaded and why it was held. The action buttons accept or reject it.

Rejecting a file

Press the reject button . A dialog asks you to confirm, and on confirmation the file is deleted for good.

Accepting a file

Press the accept button . A new page opens and asks you to confirm:

The same page offers to add an upload exception, so that files with the same extension and MIME type are accepted automatically in future without passing through quarantine at all.

Choose Add Upload Exception and the plugin looks for other held files the new rule would cover, and lists them:

In this example, pressing Accept and Add Exception accepts sample.txt2 along with sample2.txt2 and sample3.txt2, and adds a rule so that later uploads with a .txt2 extension and a text/plain MIME type are accepted without question.

An accepted file is stored where it was originally bound for, whatever post-upload actions its upload form is configured to run are carried out, and it appears in the plugin’s file viewers.

Upload exceptions

An upload exception is a rule that tells the plugin to accept, without review, any file matching certain criteria. Exceptions are created while accepting a quarantined file, as above, and are listed under the Exceptions tab in the plugin’s Dashboard area:

The table gives each exception’s category, the extension it applies to, its encoded details, and a description of what it lets through. The trash icon in the Actions column removes one.

Housekeeping

The plugin deletes quarantined files older than thirty days by itself. To keep them for longer or less long, change the Quarantined Files Life option under the Advanced tab in the plugin’s Dashboard area.

If you have questions or need more information, please contact us.

The Iptanus team