Empty PMs linked to hacking incident.

[DustyPorViva]

Disable php format from being used as an image?

[Fulg0reSama]

Originally Posted by DustyPorViva

Disable php format from being used as an image?

I like this idea personally.

[fowlplay4]

Originally Posted by DustyPorViva

Disable php format from being used as an image?

It's not that simple, you can log image requests in general. I.e. In Rails:

Started GET "/test_fowlplay4.png" for 127.0.0.1 at 2012-05-21 09:43:46 -0700

I still think the best option will be a white-list of approved image hosts, and then an player-list option to disable the rendering of external images in PMs.

Unless Stefan can script it into the PM system we'll likely need a client update (we're way overdue already).

[DustyPorViva]

Originally Posted by fowlplay4

It's not that simple, you can log image requests in general. I.e. In Rails:

Started GET "/test_fowlplay4.png" for 127.0.0.1 at 2012-05-21 09:43:46 -0700

I still think the best option will be a white-list of approved image hosts, and then an player-list option to disable the rendering of external images in PMs.

Unless Stefan can script it into the PM system we'll likely need a client update (we're way overdue already).

Not familiar with the wordfilter, so I'll use regex, but would something like this be possible for now?

RULE
CHECK pm
MATCH {php|png|jpg|jpeg|gif}\?.\>
PRECISION 100%
WORDPOSITION part
ACTION log replace
RULEEND

Be possible?

[cbk1994]

Originally Posted by DustyPorViva

Not familiar with the wordfilter, so I'll use regex, but would something like this be possible for now?

RULE
CHECK pm
MATCH {php|png|jpg|jpeg|gif}\?.\>
PRECISION 100%
WORDPOSITION part
ACTION log replace
RULEEND

Be possible?

What are you trying to accomplish? The extension is unimportant. Only the Content-Type header matters. Even without a proper image content-type header, the browser is still going to try to load it, and I still get your IP. The best solution to disable images is Jer's:

Originally Posted by fowlplay4

Append to wordfilter/rules.txt

PHP Code:

RULE
CHECK pm
MATCH <img
PRECISION 100%
WORDPOSITION part
ACTION replace
RULEEND 


As far as I know, the wordfilter rules aren't advanced enough to allow certain text to be exempted (to create a whitelist). This would have to be done with login scripts or by Stefan.