Lets say I have a website where users are allowed to upload files which will be displayed publicly as a portfolio gallery. For example, users might upload screenshots of a website they designed, or a MS Word document of some PR example text, or a PDF of their CV, etc.Some files will be blacklisted for security reasons, e.g. .zip files, .exe files and .php files.What about flash files? Is there any security concerns if I was going to host .swf files and automatically play them?<?phpif ($extension == 'swf') {    echo '<object classid=clsid:D27CDB6E-AE6D-11cf-96B8-444553540000 codebase=http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=7,0,19,0 width=640 height=430>       <param name=movie value=/'.$urlToFLV.' />       <param name=quality value=high />       <param name=wmode value=transparent>       <embed wmode=transparent src=/'.$urlToFLV.' quality=high pluginspage=http://www.macromedia.com/go/getflashplayer type=application/x-shockwave-flash width=400 height=430></embed>    </object>';}?>I guess the flash code is executed in the users browser, so if there was a security issue, it would be on their machines, not our server?
Are there any security considerations if users are allowed to upload flash files
php;flash;uploading;security
I do know flash and yes this is a terrible idea! This is what started all the trouble for myspace with self replicating virus worms. It's really simple, with flash I can get your browser to make all sorts of calls/connections/login to sites/post things as you/etc. It's amazing how much you can pull off a user with flash and report it back to any server/location on the web.Do not let your users upload/post flash unless you plan to have them send you the .fla file and you're going to code review it and compile it yourself. 