Re: Avatar Uploading and security? [XOOPS general usage questions]

1

Avatar Uploading and security?

2006/7/23 21:02
Quest
Friend of XOOPS
Posts: 1034
Since: 2005/11/19

I am using 2.0.14.

A while ago I read where there were security issues when allowing custom avatar uploads by users and that it is best to keep it off.

Is this still a security issue? I have never seen anything posted regarding it being safe with any of the upgrades.

Quest

2

Re: Avatar Uploading and security?

2006/7/24 11:25
Quest
Friend of XOOPS
Posts: 1034
Since: 2005/11/19

Bump

3

Re: Avatar Uploading and security?

2006/7/24 11:31
Herko
XOOPS is my life!
Posts: 4238
Since: 2002/2/4 1

2.0.13.2 has a mime type check added on avatar uploads, so its safer now. The security hole rumours came from the XOOPS Cube forums, and haven't been verified. That doesn't mean they're not true tho, just not verified.

Herko

4

Re: Avatar Uploading and security?

2006/7/24 11:40
Quest
Friend of XOOPS
Posts: 1034
Since: 2005/11/19

Thanks Herko! I am using the XOOPS 2.0.14. Just to be sure I understand correctly, it should have the same mime check as the 2.0.13.2 and be okay too?

Quest

5

Re: Avatar Uploading and security?

2006/7/24 11:45
Herko
XOOPS is my life!
Posts: 4238
Since: 2002/2/4 1

Just to be absolutly clear: 2.0.13 and up (so including 2.0.14) has extra security for uploading avatars.

BUT: as the security hole hasn't been verified, we have never found out what the rumour was based on, and what the hole really was. So, can you be 100% sure its safe: no.

Herko

6

Re: Avatar Uploading and security?

2006/7/24 11:49
Quest
Friend of XOOPS
Posts: 1034
Since: 2005/11/19

That holds true my friend for just about everything in life.

I understand and Thank you kind sir!

Quest

Stats
Goal:	$100.00
Due Date:	Oct 31
Gross Amount:	$0.00
Net Balance:	$0.00
Left to go:	$100.00

Avatar Uploading and security?

Re: Avatar Uploading and security?

Re: Avatar Uploading and security?

Re: Avatar Uploading and security?

Re: Avatar Uploading and security?

Re: Avatar Uploading and security?

Login

Search

Recent Posts

Re: sbadmin5 - Bootstrap 5 Theme

Re: sbadmin5 - Bootstrap 5 Theme

Re: sbadmin5 - Bootstrap 5 Theme

Re: sbadmin5 - Bootstrap 5 Theme

Re: sbadmin5 - Bootstrap 5 Theme

sbadmin5 - Bootstrap 5 Theme

Re: XoopsFaq for 2.5.10

XoopsFaq for 2.5.10

Re: activate block by default

Re: wgFilemanager released for testing and contribution

Who's Online

Donat-O-Meter

Latest GitHub Commits

{{ record.sha.slice(0, 7) }} - {{ record.commit.message | truncate }}