Avatar and image uploading safe in RN?

kingtas · New Member Joined: Apr 13, 2009 Posts: 12

Hey, I have an SMF forum that was hacked. After researching it, I found this turd has been creating accounts and uploading an avatar with malicious php code that inserts intself in all php files on the site.

Is Raven nuke prone to this or would sentinal take care of it? Should I disable uploading avatars and attachments? What about remote avatars?

I already blocked his IP in Sentinal and also in htaccess.

Thanks.

evaders99 · Posted: Thu May 21, 2009 4:40 pm

I would suggest disabling uploading for security reasons. I don't use them myself
Remote avatars are slightly less risk, but could expose your users to cross-site scripting issues.

kingtas · New Member Joined: Apr 13, 2009 Posts: 12

Ok, that's what I'll do. Thanks.

duck · Involved Joined: Jul 03, 2006 Posts: 267

I tend to favour the otherway actually. I don't trust the remotes. I prefer to hostem myself where I can manipulae em and check em if need be. Some simple excersise to reduce risk is renameing the Avatar, checking img info and or setting it to approve before available.storing temporarily outside of root till done so. Those steps alone should be suficient to ward most attacks,

Sorry grammer and spelling bad but I am on medicaton at the moment and am a litle disfunctional

evaders99 · Posted: Sat May 23, 2009 1:00 am

Let's just say, if they are on my server then I care - more than I care if its code infecting someone else's server Smile

duck · Involved Joined: Jul 03, 2006 Posts: 267

Well when its on someone elses server it can include code to steal your login info which when you're viewing it is not good so it can still be dangerous. Course I guess your are still limiting the types of vulnerabilities that can be executed that way. Coding true images to be dangerous is very difficult stuff and not something your typical script kiddie is usually capable of.

sexycoder · Posted: Tue Jun 02, 2009 10:35 pm

I agree with evaders99

Quote:

I would suggest disabling uploading for security reasons

This option should never be able. That happens when you dont make nice avatars availables on your own server. Wink