Attachments Security...

[EXreaction]

Hmm, I just tried it again, and I found it is easier than ever to do it...all that needs to be changed is this:

Code: Select all

#
# Open
#

includes/functions_upload.php

#
# Find
#

				$this->realname = $prefix . $this->realname . '.' . $this->extension;

#
# Inline, Find
#

 . '.' . $this->extension

#
# Inline, Replace with
# (delete, make sure you don't delete the ; at the end)



#
# Find
#

				$this->realname = $prefix . md5(unique_id()) . '.' . $this->extension;

#
# Inline, Find
#

 . '.' . $this->extension

#
# Inline, Replace with
# (delete, make sure you don't delete the ; at the end)

All the testing I have done with it is great, no problems at all.

[Acyd Burn]

Then try posting real media, windows media or quicktime files or try to utilize the physical download method or try to inject a second extension; also i am not sure if it is possible to force the mime extension to either use the lowest known extension (if you append an unknown one) or by submitting a file with doubled extensions, then only the last would be stripped (for the real name of course).

I can see a few potential problems arising with this change, show-stopper bugs so to say.

[naderman]

With the above method it's not possible to inject an extension or specify the extension as a user at all because an md5 hash is used.

[Acyd Burn]

then only the last would be stripped (for the real name of course).

I never said it is possible for the physical name, though might be possible if people decide to also use the real name as the physical name - and some most likely will find the code line to change. But even then it is not possible to use more than one extension since doubled extensions should be stripped by the upload class.

Anyway, at the moment i do not see a possibility of using this method without removing windows media streaming and the physical download method.

[EXreaction]

Then try posting real media, windows media or quicktime files or try to utilize the physical download method or try to inject a second extension; also i am not sure if it is possible to force the mime extension to either use the lowest known extension (if you append an unknown one) or by submitting a file with doubled extensions, then only the last would be stripped (for the real name of course).

I can see a few potential problems arising with this change, show-stopper bugs so to say.

I tried a wmv, and that worked exactly the same...don't have any rm or quicktime files(or know how to make one and get it smaller than 2MB).

I tried the physical download method and well, that did not work the best.

Multiple extensions are not a problem, I tried php.php.php.php.php.php.php.php.php.php.php.php.php and it was still 2_8bb1107e0342feb5ca44ffe8e24e1887


EDIT: If you don't want to setup a board to try it yourself, I can set one up with the change on a server of mine and give you FTP and admin access.

[EXreaction]

Bump.

Now that Physical Mode has been removed what do you think of implementing this Acyd?

[Acyd Burn]

Bump.

Now that Physical Mode has been removed what do you think of implementing this Acyd?

This is already implemented and the reason why the physical mode got removed.

[EXreaction]

This is already implemented and the reason why the physical mode got removed.

Wow, I guess I should have tried it first!

Very, very awesome. 8)

[houser]

Is this change in beta 5?
I am seeing some issues with Safar OSX, as discussed in the supportforum here:
http://www.phpbb.com/phpBB/viewtopic.ph ... chments%2A

I would just like to know what I should be looking for in my testing.

best
Janne A.