Drupal file upload by anonymous or untrusted users into public file systems -- PSA-2016-003

See:

https://www.drupal.org/psa-2016-003

#2816405: Warn admin users on site status report page if insecure webforms are found

#2816121: [meta] Is there anything webform can do to mitigate PSA-2016-003?

#2816303: File upload destination should be private files by default if available

Possible solutions

• Add warning that is displayed when public file uploads are enabled.
• Managed file upload directory should default to 'private'.
• There should be a global setting that defaults to require all file uploads to be private.
• If the private files directory is not setup block the managed_file element from being used.
• Managed file element support may need to be optional