Cant display images in the same way?

[takai]

Yeah, im runnign the rewrite URL module

[MWP]

There are security issues involved in allowing Dynamic URLs.

Hmm, i wonder what security issues there are.

There cant be any to the forum itself as its just passing a HTML image tag.
I cant think of anything that would effect a user of the forums either... i have never seen any complaints in forums that do have it turned on (did you guys get any from the old forum?).

[Nark]

I doubt that the security issues would be to the forum software unless there was some buffer overflow exploit.

The main issue is with the forum users. People can put links in that can take advantage of holes in the browser that could possibly run malicious code on the user's computer.
Not saying that it would happen, but it could happen.

[MWP]

I cant see how that is any different than just a static image/file though.
After all a dynamic URL is just data that can change over time, it has nothing to do with its content.

For example, the forums would allow this because its not dynamic:

[imga]http://virus.com/thisisbad.exe[/imga]

(i used imga instead of img above otherwise the tags dont show)

In the end its up to the web browser to decide whats ok and whats not.

[Nark]

But what if the PHP file produced code that utilised a flaw in the browser's/OS's image rendering functionality.
Such as the WMF code execution vulnerability that's currently on the High Risk list?
It's not the first time there's been a hole in a graphics rendering engine.

Having said all this, I do agree that not enabling that option is being a bit paranoid.

[MWP]

But what if the PHP file produced code that utilised a flaw in the browser's/OS's image rendering functionality.
Such as the WMF code execution vulnerability that's currently on the High Risk list?
It's not the first time there's been a hole in a graphics rendering engine.

Thats true, but my point is its no different than having a static link to a image with that problem.

Having said all this, I do agree that not enabling that option is being a bit paranoid.

Good
Would be nice to put my 1UZ RA28 project thread up in these new forums.

[MWP]

Any news on this?

[MWP]

Testing again...



[edit]
Ok, still doesnt work.
Can you guys please fix this!
It is NOT a security issue.

[takai]

Testing again...

Hm, i wonder if this works.

Edit: obviously not.
MWP: does Agg have dynamic naming (mod_rewrite) turned on?