Thread: Attachment permissions

Hello Members,

I had to disable the use of attachments and images on the forum because someone has been trying to upload a .php file disguised as an image file and have been trying to execute it remotely and this has happened more then once but due to some security measures we have in place our forum was not compromised and these attempts are on the rise and we cannot risk the whole forum going down due to this.

I will enable attachments as soon as I find a solution to this problem. Sorry about the inconvenience.

Thanks
Parminder

No problem Admin. Forum's safety is most important....Till then we can upload file on any other server and can give link in the forum..

You can reduce the size of the attachments, and disallow *.zip and *.rar formats.
I feel for a JPG/PNG say 100 KB will do.
( Also for Insert mode )

thanks for checking that admin..

alternate ways to attachments:-

have a google account.
sites.google.com
make your unlimited sites on it..(thats what google actually wanted.. spam 'em)
now open any site for edit.. (its easy, it will happen like a ms-doc stuff)
attach your file.. (or you can directly attach your file on the page bottom)
now link the file here.. its safe+google won't allow fake stuff going into attachments..

@admin
btw forums are best place for "peeps" to put their codes because of the html and java ability.. its a basic vulnerability of a phbb that cant be wholly terminated..

Originally Posted by essbebe

You can reduce the size of the attachments, and disallow *.zip and *.rar formats.
I feel for a JPG/PNG say 100 KB will do.
( Also for Insert mode )

Someone has been uploading .php files disguised as .jpg and executed it remotely. I have restricted remote execution somehow but there are still loopholes and all vbulletin forums are at risk not just this. will find a way out soon.

Is there any option to block attachments before, say 100, posts? I guess not.

There must be a mod available for that. Will try and find one.

Actually many forums allow limited attachments only. They suggest using file hosting sites for attachments.

We have a mod in place now will sort out the settings before I go to sleep tonight

well in this forum people can have their files hosted on some third party and paste the image url here..