is there a way to allow users to link to off-site avatars?

Just to clarify, you don't want users to upload their own? User's can upload their own avatar if that's allowed in admin -> system -> preferences -> User Preferences. Then if a user wants their own, they just download from one site and upload to yours.

Anyways, if that's not what you're interested in, then the answer is no... it could be a dirty hack.

Hope that helps,
Keith

Quote:

Do you really want users to do that? Leads to endless problems and security issues. It is very easy for them to upload to their account. You want to limit the pixel width and file size which you can't do so easily with remote.

Small space required on your server. And if they have avatars larger than the limits I wouldn't want to see it as a user since it slows things down.

Side note: the same users asking for remote avatars will ask for local upload of images and apps in the Forums. That is another story.

I would think that allowing users to place their files on your server would be a larger security risk. I've used several different boards over the years on my sites, and I've always preferred the off-site linking, rather than allowing people to put files on my server.

As for the file itself being evil in some way there isn't a difference being local or remote, it still gets delivered. No advantage to being remote.

If you're worried that the web server could be at risk instead of just the browser I don't think so. At least I can't imagine my server being exploited by pushing an image out.

But, the server has control over the size and Mime content. And maybe some other checks I don't know about but assuming nothing more there are more advantages to local.

First being the size. Every site I've been on that did remotes there were broken or slow avatars in too many messages. Screw the vanity, I want the message not the label.

When my browser asks to run a flash/shockwave or other unneeded function of the avatar I say no thanks. That seems to be a security issue unique to remote avatars.

So, have users put their silly remote thingies in their signature. I think that would work almost the same.

Thanks for all the info. I really appreciate it.