Avatar size

[Cloud]

With phpbb2.0.x avatar size limits could be broken by linking to an off site avatar.... Is there any chance that this will be "fixed" in 2.2?

[lotsalag.net]

i certainly hope so

this is a big problem in phpbb atm

[psoTFX]

argh!

It's impossible to guarantee that an offsite avatar is within the dimension and filesize limits ... unless you're willing to sacrifice rendering/processing time. The only way to achieve this would be to check the avatar each and every view. That would require a remote connection be made and the dimensions obtained. If you wanted to ensure filesize limits were met you'd need to grab the entire avatar (since filesize cannot operate on remote files). On slow remote servers this would (browser depending) halt rendering while the process is carried out. It would also impose additional load on the server since every such avatar would require a new script process.

In 2.2 what I have done is require size (width and height) dimensions be entered ... if they aren't the dimensions (for all avatar types) are obtained if possible. So yes, it is tackled in a "sort of way" ... but if you're worried about users abusing the remote avatar capability, disable it and use a more appropriate (gallery or upload) method.

[haravikk]

What you've put in should do it shouldn't it? If a user chooses an image remotely then they are required to put in dimensions, if these are in excess of the maximum it will refuse it, if unentered then it will default to max? That would track the dimensions fine which is the main problem really.
If moderators can be given access to edit "minor" user items like signature, avatar etc then filesize can be avoided with moderators checking any suspect images and disabling them if necessary

[dhn]

Thinking aloud, shouldn't it be enough to get the size of the remote avatar when the link is entered and then just hardcode it (if it is within the limits?)? I don't think having a user entering the size manually is a good idea, simply for usablitly reasons.

[Madcow]

Like saying in the <img> tag that highth is a certain number of pixles and width is a certain number of pixles?

[dhn]

Yep.

postcount++

[psoTFX]

When you upload (form or box) or link to an avatar phpBB attempts to set the width and height details automatically. If it cannot it will drop back with an error. Remember that some servers will sit behind firewalls where no new (syn) connections may be established ... in these cases we cannot obtain the dimensions. If we don't allow manual setting we may have a few peeved users.

No, this is not a perfect solution for the "problem" (as I've explained many many many times before ). It doesn't stop users replacing their remotely linked 6kb avatar with a 1.2MB version (of whatever dimension), nor does it prevent someone changing it for a larger or smaller avatar which will look totally "wrong" when viewed.

The only way to guarantee an avatar meets your min/max dimension/filesize limits is to upload it to your server ... there you have complete control over it.

[Nuttzy99]

Yep.

postcount++

Your forgot the ";"

Code: Select all

<?php
  global postcount ;

  postcount++ ; //  :P 
?>

-Nuttzy

[Bertg]

idea....

(should be in tracker i know...)

In the admin section you could include a "Check remote avatars"-function...

This sould be able to see if size or dimetions are not in order...
(if not by script, I't 'll be posible on view)

Then you can warn that usere, or delete his avatar..

-bert-