Printable View
It is standard for Jupitermedia forums that the forum settings be defaulted to not allowing dynamic image tags. VBForums has had this setting turned on. Until recently, this has not been abused and so I've left the setting alone. The setting has now been turned off because it has been abused.
Sorry - it is a security issue, so it is now turned off. Feel free to yell and scream at me if you have issue with this -- unless you are one of those that abused it.
Brad!
Using PHP, people can still make dynamic images so unless you disable the image tags, it can still be done.
BTW, how did someone abuse it?
http://www.vbforums.com/attachment.p...postid=1599755
Edit: Hey... whoa :eek:
That sucks. !
I don't get it... How do you mean abused?
Correct. That option was turned off.Quote:
Originally posted by mendhak
Isn't there an option which allows you to enable dynamic images for signatures only?
Brad!
I don't get it.
:( :mad: :(, My signiture makes no sense now :(.
It isn't possible to limit the file types that the Image Tag works on? or that it only allows vbforums Attachments (obviously would still need to disable php. :).
The change should only have hurt you if you are using PHP for the image. The issue is in allowing the img tag to run PHP code.
You should still be able to link to image files (jpg, gif, etc) with no issue.
Brad
They are not conserned about the browser, they are worried about their server.Quote:
Originally posted by Spetnik
What malicious activity can be done by a php? PHP is a server-side script which can do no more to a browser than a jpg or a gif (when used in an image tag).
Brad, IMG tags now no longer work in the text of a post.
The PHP wouldn't be run on their server, apart from their own scripts (e.g. Attachment.php), would it?Quote:
Originally posted by kasracer
They are not conserned about the browser, they are worried about their server.
So does this mean I can put me graphics on my own Site then link em over?
:wave:
Its Good to be The King!
http://www.vbforums.com/attachment.p...postid=1633621
:D
He's just done the same thing I have done. Hosted it myself as a .gif or .jpg file.Quote:
Originally posted by NotLKH
:wave:
Its Good to be The King!
http://www.vbforums.com/attachment.p...postid=1633621
:D
I've talked to the system admin and we've agreed to change the setting back.
We will simply ban individuals that do anything inappropriate. If you are not sure if something is inappropriate, then I suggest asking before doing.
I'd like to thank those of you that raised the issue in a constructive manner. (Both that caused the setting to be turned off and now to be turned back on.)
Brad!
woohoo :D:D
I just noticed, I've got that book :P Quite good actually :)Quote:
Originally posted by NotLKH
:wave:
Its Good to be The King!
http://www.vbforums.com/attachment.p...postid=1633621
:D
I still don't get how it was abused and what is inappropriate...
I won't post how it was abused because that will just tempt a number of people to try a few things out. No point in tempting anyone :D.
Things that are inappropriate can be determined by reading the Acceptable Usage Policy. That details most things.
Brad!
Could you PM me and tell me? You've really made me curious. And speaking of PMs, is there a limit to how many we can have?
There is a limit to the number of PMs. I'm not sure what the setting is. You can always delete old ones to make more room.
Brad
I think its around 150/160.Quote:
Originally posted by brad jones
There is a limit to the number of PMs. I'm not sure what the setting is. You can always delete old ones to make more room.
Brad
The maximum number of saved messages a user can have is 200.
OK, thanks :)
After thinking about it... the only real security issue is that you could track people with it. Anyone seen those images where they tell you what browser and OS your using? The other possibility is that it could perhaps replace the image with something else down the track?
I don't think it would allow code execution, since all its doing is taking the text from the [IMG] tags, and not actually opening the file itself. Not on the VBF server atleast, and since PHP is server side, you'd have to use include/require, meaning that you should have trouble with PHP code...
On the page is another matter, as in theory I guess you could put anything you wanted in there, like a frame? Since the file requested would be turned into HTML on the server of the image and then displayed somehow... ?:dunno:
Anyone want to slap me silly/agree with me? :p Be it in this thread or otherwise. :)
Sorry, I'm making my own PHP forum software, so its an interesting thing to think about. :)
I'll slap you later.
By doing that, you could execute whatever PHP code you wanted, but the only thing you could return is an image. Returning anything else will give you one of those cool little boxes with a red X in it (well, in IE, anyways).
So what are we worrying about then?Quote:
Originally posted by The Hobo
I'll slap you later.
By doing that, you could execute whatever PHP code you wanted, but the only thing you could return is an image. Returning anything else will give you one of those cool little boxes with a red X in it (well, in IE, anyways).
Me = PHP noob. :)
I don't know...Nazis? Did we defeat them yet? Commies?Quote:
Originally posted by Pc_Madness
So what are we worrying about then?
Ah, terrorists. That's what it is today.
Terrorists are hijacking our images. :eek: