.svg as user uploaded attachments or [img] links

General discussion of development ideas and the approaches taken in the 3.x branch of phpBB. The current feature release of phpBB 3 is 3.3/Proteus.
Forum rules
Please do not post support questions regarding installing, updating, or upgrading phpBB 3.3.x. If you need support for phpBB 3.3.x please visit the 3.3.x Support Forum on phpbb.com.

If you have questions regarding writing extensions please post in Extension Writers Discussion to receive proper guidance from our staff and community.
User avatar
3Di
Registered User
Posts: 951
Joined: Tue Nov 01, 2005 9:50 pm
Location: Milano 🇮🇹 Frankfurt 🇩🇪
Contact:

Re: .svg as user uploaded attachments or [img] links

Post by 3Di »

Since I have an extension that allows you to use (not directly upload from within the container) SVGs manually uploaded by users I foresee that I will still implement sanitization before their use. So the link could be useful to me. Thank you.
🆓 Free support for our extensions also provided here: phpBB Studio
🚀 Looking for a specific feature or alternative option? We will rock you!
Please PM me only to request paid works. Thx. Want to compensate me for my interest? Donate
My development's activity º PhpStorm's proud user º Extensions, Scripts, MOD porting, Update/Upgrades

sanekplus
Registered User
Posts: 1
Joined: Tue May 04, 2021 2:01 pm

Re: .svg as user uploaded attachments or [img] links

Post by sanekplus »

There is a simple core patch enabling SVG post attachment as image for those who come here from search engine like me. Out of the box phpBB 3.3.X allows to embed SVG as external image and modern browsers render it correctly. But when you add .svg extension as image file extension in the administration panel, phpBB will not allow you to attach SVG because of getimagesize() can't determine sizes of SVG. Patch below fixes this behavior. Do it at your own risk, SVG may have some security issues.

Code: Select all

--- phpbb/files/upload.php	2021-05-04 14:18:05.645926447 +0300
+++ phpbb/files/upload.php	2021-05-04 14:18:42.826388405 +0300
@@ -385,6 +385,10 @@
 		{
 			$result[IMAGETYPE_SWC] = ['swc'];
 		}
+		if (defined('IMAGETYPE_SVG'))
+		{
+			$result[IMAGETYPE_SVG] = ['svg'];
+		}
 
 		return $result;
 	}
--- phpbb/files/filespec.php	2021-05-04 13:53:05.355263882 +0300
+++ phpbb/files/filespec.php	2021-05-04 14:30:16.275004602 +0300
@@ -506,7 +506,18 @@
 		{
 			$this->width = $this->height = 0;
 
+			if ($this->mimetype == 'image/svg+xml') 
+			{
+				if (!defined('IMAGETYPE_SVG'))
+				{
+					define('IMAGETYPE_SVG', 99);
+				}
+				$this->image_info = [ 'width' => 1, 'height' => 1, 'type' => IMAGETYPE_SVG ];
+			} 
+			else
+			{
 			$this->image_info = $this->imagesize->getImageSize($this->destination_file, $this->mimetype);
+			}
 
 			if ($this->image_info !== false)
 			{

User avatar
3Di
Registered User
Posts: 951
Joined: Tue Nov 01, 2005 9:50 pm
Location: Milano 🇮🇹 Frankfurt 🇩🇪
Contact:

Re: .svg as user uploaded attachments or [img] links

Post by 3Di »

If it were that simple it would have already been implemented (even in more detail) but unfortunately it's not.
As you also pointed out, SVG is a risk and I do not recommend the above code. :)
🆓 Free support for our extensions also provided here: phpBB Studio
🚀 Looking for a specific feature or alternative option? We will rock you!
Please PM me only to request paid works. Thx. Want to compensate me for my interest? Donate
My development's activity º PhpStorm's proud user º Extensions, Scripts, MOD porting, Update/Upgrades

Post Reply