Patched Flash Uploader to Fix Known Exploits

[alexm]

UPDATE Dec 2014: 4.2.2 PL2, 4.2.2 PL3 and 4.2.3 core download packages from vBulletin now include this patched version of uploader.swf as standard.

This is a patched version of YUI 2.9.0 uploader.swf as used by vBulletin 4.x for managing multiple file uploads.

An exploit was found (http://yuilibrary.com/support/20131111-vulnerability/) in the flash uploader (uploader.swf) file supplied with vBulletin 4.x. This file is part of the Yahoo YUI 2 Library which is end of life and Yahoo have stated that they will not be fixing it. Yahoo recommends that the file is removed as the flash uploader has been deprecated.

vBulletin's recommended fix (http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4014388-yui-security-issue-found-in-uploader-swf) is to replace the file with an empty file of the same name. If you do this, however, and rely solely on the Ajax uploader you will not be able to select multiple files without further modifications.

This modification is a recompiled version of uploader.swf with the above exploit fixed. An additional potential exploit has also been fixed by disabling a parameter not used by vBulletin.

The YUI source (https://github.com/yui/yui2) used is provided freely by Yahoo (https://yuilibrary.com/license/) to whom I give full credit.


1) Installation

a) Extract uploader.swf from the .zip file and replace your existing file here:

<forum_root>/clientscript/yui/uploader/assets/uploader.swf

b) Make sure the flash uploader is enabled in the Admin Control Panel

Options -> Message Attachment Options -> Asset Manager - Enable -> Select "Yes, Flash Upload by Default"

c) Make sure you are NOT using remote YUI

vBulletin Options -> Server Settings and Optimization Options

Use Remote YUI set to None

d) You may also need to clear your browser cache and/or vBulletin cache (Maintenance ->Clear system cache) if you have performed the above steps correctly but clicking the Upload button still does nothing.



2) Changes

11th January 2014

The parameter 'allowedDomain' has been sanitised with a REGEX to prevent malicious javascript being passed in a query string.


11th January 2014 v2

Many thanks to FranzBanz (http://www.vbulletin.com/forum/member/449383-franzbanz) for his suggestions


finding another exploit (using another parameter). Exploit fixed by setting the parameter (not used by vBulletin) to null.
'-' Character added to allowed characters in allowedDomain



Non-Flash Alternative
Please note that if you would rather avoid using flash altogether an alternative Mod has been released by BirdOPrey5 (https://vborg.vbsupport.ru/member.php?u=258922), although there are some compromises/limitations with IE10+.

Asset Manager / Image Upload Fix to upload multiple files like the Flash uploader (https://vborg.vbsupport.ru/showthread.php?t=306915)


DISCLAIMER
I am not a flash developer, I am just another vBulletin customer trying to keep his members happy!
This file is provided free of charge for the benefit of the vBulletin community. You use it at your own risk!


Copyright ? 2013 Yahoo! Inc. All rights reserved.
Redistribution and use of this software in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

Neither the name of Yahoo! Inc. nor the names of YUI's contributors may be used to endorse or promote products derived from this software without specific prior written permission of Yahoo! Inc.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

[ckgb]

Thank you very much!!!

[Diesel,]

Thanks for the Patch.

[tester559]

Thank you :) I appreciate your time in fixing this issue

Stuart

[Mark.B]

Thanks very much for your work on this, it is much appreciated by many of us who miss the Flash functionality.

I'll get this installed on my own site in the next few days.

[BirdOPrey5]

Thank You. :)

[bzcomputers]

I'm always worried about when my vb4 will inevitably be forced to retire and in turn force me to move on to something else due to issues like this that arise.

Luckily there are still some great coders around supporting it. Unfortunately fewer and fewer these days though :(

Thanks for the fix.

[Hostboard]

Thank you 100x over.

[puertoblack2003]

thank you for you time and the patch.

[hugh_]

Great work, thank you!

[ezak]

thank you installed

[Thangvip9x]

Thank you

[tommyxv]

Thank very much!

[Trevor Matthews]

Hi
Excellent work and has saved many of us from lots of trouble on our forums.
Many thanks.

[miszko]

Thanks man! I also nominated this mod to MOTM.

[keyla31]

ive done this but for some reason when I click select files a new box to browse computer files does not pop up? And ideas?

[alexm]

ive done this but for some reason when I click select files a new box to browse computer files does not pop up? And ideas?

Try clearing your browser cache

[Paul M]

Irrelevant posts and comments removed.

This is a modification release thread, not another "lets attack IB" thread.

[MrD]

Thx

[keyla31]

ive done this but for some reason when I click select files a new box to browse computer files does not pop up? And ideas?

cleared browser like recommended and this worked, now working perfectly in 4.2.2 Thank you so so much

[Thangvip9x]

Working on vBulletin 4.2.2, thank you very much

[Rebecca217]

Thank you so much for taking the time to fix this, and to make it available to the rest of us! :)

[migratoria]

Tanks for the fix!

[SomeSailor]

This should be included as a patch to all VB installs. Thank you very much!

[tpearl5]

This should definitely be included as a patch! Thanks!

[migratoria]

In vb 4.2.2 works...

[rootsxrocks]

Thank you

[Phaedrus]

Cool. Let's see if anybody at my site notices.

[BarracodE]

Thank you so much. This issue was difficult to track down. Multiple images is very important to our users. Clearing the browser cache was the final missing piece. Thank you!

[Jaydee 2]

Many thanks for this fix. :) It was an good idea!

I'll install it approximately in just one forum (just for testing it) and maybe later on in all the remaining ones.

[bombardier]

Well I cant say I fully understood what the issue was only that there was one.
I have installed this fix and have experienced no noticeable change or issues.

whatever the problem was it is fixed and I thank you very very much for your efforts.

[GONUMBER6]

Thanks!!!!!

[DemOnstar]

MOD of the month this month surely....

Well done in advance alexm.....

Voted!

[dougdirac]

Kinda sad that basic maintenance ends up being so praiseworthy. We've long giving up on features or improvements.

[Boulard83]

MUCH MUCH appreciated, big +1

[Silver_2000_)!]

Uploaded the file and the button still doesnt work - im sure I missed some step ...

[naveeid]

This is great , i was looking for this solution , the response from Vbulletin official team on this issue was hopeless ,

but alexm you have taken the right step , great work. thanks.

[XiTCLUB]

Thanks for this big help !!

[tom w]

Being a paranoid security type, any chance of getting the source code for this replacement file? Since it doesn't come from either Yahoo or VBulletin (for whatever reason) I'm reluctant to trust files from a relatively unknown sources (though it's great people like to help) which could introduce other vulnerabilities that we'd never know about.

[hoangserip]

Thanks for the Patch.

[alexm]

Being a paranoid security type, any chance of getting the source code for this replacement file? Since it doesn't come from either Yahoo or VBulletin (for whatever reason) I'm reluctant to trust files from a relatively unknown sources (though it's great people like to help) which could introduce other vulnerabilities that we'd never know about.

I would be happy to share the source with another developer if their suggestions/feedback helps the community as a whole, but how would you know if I've given you the correct source? And, also being a paranoid security type with a busy vB4 forum myself, how do I know you aren't looking for vulnerabilities to exploit yourself? :p

I think the easy answer is if you understand Flash it's very easy to decompile the SWF yourself and look at the source. That's basically what I did to get it working anyway. :D

If anyone does find an issue let me know and I'll do my best to incorporate a fix.

[BirdOPrey5]

Being a paranoid security type, any chance of getting the source code for this replacement file? Since it doesn't come from either Yahoo or VBulletin (for whatever reason) I'm reluctant to trust files from a relatively unknown sources (though it's great people like to help) which could introduce other vulnerabilities that we'd never know about.

FYI

There are many free flash / swf file decompilers online you can upload the .swf file and get the source yourself.

For example - http://www.showmycode.com

[furnival]

I belatedly upgraded to VB 4.22 and had to reinstall this afterwards. This should be incorporated into the next VB 4 release so that everyone doesn't have to reinstall this once more.

[msnhockey]

I cant seem to get this to select more than 1 image in IE or Chrome with the settings in the instructions and with deleting browser cache. any ideas?

I am using IE 11 and Chrome version 33.0.1750.146

[Zachery]

I belatedly upgraded to VB 4.22 and had to reinstall this afterwards. This should be incorporated into the next VB 4 release so that everyone doesn't have to reinstall this once more.

there are no plans to add the flash uploader back, in any form, at this time.

[joeychgo]

there are no plans to add the flash uploader back, in any form, at this time.


Zack, is there any reason to think this fix doesn't solve the problem? If not, then why not add it back with this fix?

[BirdOPrey5]

Zack, is there any reason to think this fix doesn't solve the problem? If not, then why not add it back with this fix?

Legal reasons...

[Zachery]

Zack, is there any reason to think this fix doesn't solve the problem? If not, then why not add it back with this fix?
It may solve today's problems, but not tomorrow, or the day after, or the day after.

There have been a long and sordid history with the flash uploader, and YUI's security of flash scripts. The YUI devs themselves have abandoned the script.

We can address the changes with something like relying on the HTML5 constructs of modern browsers instead by adding a simple MULTIPLE line to the input. That'd be the fix we'd go with, without adding another issue into the mix.

[tbworld]

Thanks @Zachery, nice explanation. Always appreciated. :)

[Reef Man]

It does not wolve the problem. I have 4.2.2

[tpearl5]

It does not wolve the problem. I have 4.2.2

You're right, it sounds nothing like an organ. But this patch does solve the problem of the flash uploader not working.

[Jennifer2010]

On 4.2.2 PL1, I get this error:

404 [IOErrorEvent type="ioError" bubbles=false cancelable=false eventPhase=2 text="Error #2038"]

It happens every time an image is uploaded, regardless of image size, format, dimensions or file name. After selecting the image to upload and then clicking upload, the progress bar completed and then the red arrow appears next to the file which when hovered, shows that error.

We don't have security software installed on the server and the max fliesize limit within VB and in php/mysql is over 100MB (vb's restriction is 1MB per file but we've tried as low as 10kb and it reports the error shown above).

Any help is appreciated.

[ForceHSS]

On 4.2.2 PL1, I get this error:

404 [IOErrorEvent type="ioError" bubbles=false cancelable=false eventPhase=2 text="Error #2038"]

It happens every time an image is uploaded, regardless of image size, format, dimensions or file name. After selecting the image to upload and then clicking upload, the progress bar completed and then the red arrow appears next to the file which when hovered, shows that error.

We don't have security software installed on the server and the max fliesize limit within VB and in php/mysql is over 100MB (vb's restriction is 1MB per file but we've tried as low as 10kb and it reports the error shown above).

Any help is appreciated.
http://www.vbulletin.com/forum/forum/vbulletin-4/vbulletin-4-questions-problems-and-troubleshooting/403407-i-cant-upload-photo

[Jennifer2010]

http://www.vbulletin.com/forum/forum/vbulletin-4/vbulletin-4-questions-problems-and-troubleshooting/403407-i-cant-upload-photo

Doesn't help. Blames it on server settings, which is why I mentioned in my comment that we don't have security software installed and our php settings aren't restricting anything.

Are we supposed to have anything for custom YUI path? Currently it's set to "none" (no Google/Yahoo library) and the path is blank beneath that.

[Zachery]

So, to deconstruct the error:

404 Error #2038[/COLOR]"]
This is the status of the page returned, 404 after the uploaded completed.

This is the error flash returned, which says IO error. This is a super generic, Input/Ouput error thrown by flash. More or less the file wasn't there, when it was done uploading.

This is a [I]server issue, and the problem is your server. Some security, or other server setting is blocking the flash uploader from working, period.

mod_security
suhosin
A module of selinux
Anti(malware/virus) scanners
reverse proxies
bad upload configuration
An internal server error may even be hiding the real error message.


If you disable the flash uploader, to use the ajax one instead, does it work? Yes/No
If you disable the asset manager for the legacy uploader, Does it work? Yes/No

Does the AdminCP > Maintenance > Diagnostics > Upload File test work? Yes/No

[Jennifer2010]

mod_security - Not installed
suhosin - Not installed (using suexec)
A module of selinux - Not installed
Anti(malware/virus) scanners - Not installed
reverse proxies - We're using NGINX?
bad upload configuration - Not sure what this correlates to.

If you disable the flash uploader, to use the ajax one instead, does it work? Yes/No
One image at a time works. Multiple files selected results in the images not being inserted into the post. (one image at a time does not work on flash uploader)

If you disable the asset manager for the legacy uploader, Does it work? Yes/No
One image at a time works. Multiple files selected results in the images not being inserted into the post.

For example, I upload two different images one at a time and it works. If I select both of them and try to insert them, they fail and neither are inserted.

Does the AdminCP > Maintenance > Diagnostics > Upload File test work? Yes/No
Yes

file_uploads: On
open_basedir: None
safe_mode: Off
upload_tmp_dir: /tmp
upload_max_filesize: 100.00 MB

No errors occurred while opening the uploaded file for reading.

What should my image storage directory permissions be?

Thank you

[Jennifer2010]

Problem resolved:
We have a custom "Upload Images" button that calls the same function as the insert image button does on the post editor. However, after we upgraded to 4.2.2 it must not be compatible. Thus, all we have to do now is find the new code and it should work (default vb style works perfect)

I can't remember where I found the old code:
<span class="cke_button">
<input type="button" style="height: 30px; width: 100px; font-size: 14px; margin-top: 15px;" a id="cke_38" class="cke_off cke_button_vbimage" onclick="CKEDITOR.tools.callFunction(77, this); return false;" onfocus="return CKEDITOR.tools.callFunction(76, event);" onkeydown="return CKEDITOR.tools.callFunction(75, event);" onblur="this.style.cssText = this.style.cssText;" aria-labelledby="cke_38_label" hidefocus="true" tabindex="-1" value="Upload Images">
</a>
</span>

Anyway it's not a server issue anymore, lol.

[camoit]

Worked for me V4.1.12
it's a shame VB won't fix the problem. I guess they want to sell new versions.

[Zachery]

Worked for me V4.1.12
it's a shame VB won't fix the problem. I guess they want to sell new versions.

So, you're just going to ignore what we've already commeted on?

We have other fixes, it just wont' be the flash uploader.

[MySaltyreef]

you sir are a legend ! working perfectly on 4.2.2

[K!nG]

Not working for me on 4.2.2 Patch level 1. Yes i also have flash upload enable in admincp. Any help ?

Thanks.

[ForceHSS]

Not working for me on 4.2.2 Patch level 1. Yes i also have flash upload enable in admincp. Any help ?

Thanks.
explain the steps you took after downloading the plugin

[K!nG]

After downloading i extracted the file to my desktop then i replaced the one i had and after that i checked into admincp to Make sure the flash uploader is enabled.

Now when i try to post an image from desktop by clicking on Inset Image icon, pop up comes and select from computer and when i click on Select Files nothing happens. It doesn't do anything.

[ForceHSS]

After downloading i extracted the file to my desktop then i replaced the one i had and after that i checked into admincp to Make sure the flash uploader is enabled.

Now when i try to post an image from desktop by clicking on Inset Image icon, pop up comes and select from computer and when i click on Select Files nothing happens. It doesn't do anything.
So you logged into your ftp and when to clientscript/yui/uploader/assets
Folder and uploaded the uploader.swf file you mean?
Then when to your admincp/Options -> Message Attachment Options -> Asset Manager - Enable -> Select "Yes, Flash Upload by Default

[K!nG]

Yes & Yes. Did exactly what was in instructions and what you just mentioned above, but nothing happened.

[ForceHSS]

disable all plugins via config then test

[Zachery]

Yes & Yes. Did exactly what was in instructions and what you just mentioned above, but nothing happened.

Does AdminCP > Maintenance > Diagnostics > Upload Test works?
ARe you using local, or remote YUI under the Server Settings / Optimization Options?

[K!nG]

disable all plugins via config then test

I just disabled all plugins via config and nothing happened. Still not working. When i try to click on "Select Files" nothing happens.

[K!nG]

Does AdminCP > Maintenance > Diagnostics > Upload Test works?
ARe you using local, or remote YUI under the Server Settings / Optimization Options?

Here is what i got in diagonstics>Upload test.

https://vborg.vbsupport.ru/external/2014/04/34.jpg

I am using Remote YUI.

[Zachery]

You can't use a REMOTE YUI, you have to use a local one. The SWF uploader on google/yahoo's servers have been removed.

[K!nG]

You can't use a REMOTE YUI, you have to use a local one. The SWF uploader on google/yahoo's servers have been removed.

So basically this means i should upload the attached file and change it to local and it should work or should i just upload the empty file and change it to local ???

[K!nG]

You can't use a REMOTE YUI, you have to use a local one. The SWF uploader on google/yahoo's servers have been removed.

Hi Zachery,

Even after selecting NONE i am still not able to get it done. When i click on "Insert image" nothing happens.

[Zachery]

What browser?

[K!nG]

Using google chrome.

[K!nG]

Since u asked for browser , I just checked it in IE and it's working fine. I only use chrome and it was working fine, but all of sudden it's not.

[Toorak Times]

For some reason a lot of my plugins will not even appear in Google Chrome but appear in Firefox and Safari no probs

[rharbison]

Update - The problem seems to be in VB 4.2.2 itself, even when using the 0 byte version of Uploader.swf, the problem still exists.

VB 4.2 PL 1 seems to have broken this. With the modified version of uploader.swf, the images SEEM to work. While editing your message they show up in the post just fine. However... When you save the message, you only get a link to the attachment, not the image.

Anyone else seeing this? Anyone got a solution?

[alexm]

Since u asked for browser , I just checked it in IE and it's working fine. I only use chrome and it was working fine, but all of sudden it's not.


a) Upload the modified SWF file and make sure the flash uploader is enabled in the Admin Control Panel

Options -> Message Attachment Options -> Asset Manager - Enable -> Select "Yes, Flash Upload by Default"

b) vBulletin Options -> Server Settings and Optimization Options

Use Remote YUI set to None

c) Close your forum page and clear your browser cache - a lot of the issues where clicking the upload button does nothing is due to browser caching issues

Hopefully this helps!

[alexm]

Update - The problem seems to be in VB 4.2.2 itself, even when using the 0 byte version of Uploader.swf, the problem still exists.

VB 4.2 PL 1 seems to have broken this. With the modified version of uploader.swf, the images SEEM to work. While editing your message they show up in the post just fine. However... When you save the message, you only get a link to the attachment, not the image.

Anyone else seeing this? Anyone got a solution?

I can't replicate this I'm afraid. I'm using 4.2.2 PL1 too and everything seems to work just fine. I'm using the standard, unmodified editor with asset manager and attachments work both via asset manager and in quick reply.

[rharbison]

OK, so here's the odd thing. I run about 6 forums (yes, all licensed). All are, as far as I know, the same. All are running V 4.2.2 PL1. One of the forums is having a problem with the attachments not showing up inline. It's reproducible, but also somewhat random.

[alexm]

Not sure what to suggest... presume you've tried re-uploading all the vBulletin files in case something got corrupted during transfer? (remember to replace uploader.swf again afterwards!)

If that doesn't do it then maybe try reverting any relevant templates?

[rharbison]

Alex, yep, tried re-uploading.

My templates are all stock, I've run VB for many years ago, and long ago tired of customizing everything like a kid putting rims and spoilers on his new ride, only to have a new release require them to all be done over. I now run my forums as stock as I can possibly get and try to do any customizing, like ads, from within the framework.

What's really strange is why a couple forums on the same server would have one not work and another one work. But in any case, I decided I'd had enough hassles to trying to make it work and decided that was going to be my XF testbed.

[weave]

This is no longer working for me on 4.2.2 PL1 either. Clicking the button does nothing at all.

I have made sure I have the right file and settings no less than 3 times.

I have run the maintenance test, no issues found.

I have tried with.

APPLE:
Safari
Chrome
Firefox

Windows7:
IE 11
Firefox

Windows8:
IE11

The ONLY time I got it to work was on Windows with IE and all plugins/hooks disabled. It still was not working on the others.

Any ideas?

Thanks

[alexm]

This is no longer working for me on 4.2.2 PL1 either.

I have made sure I have the right file and settings no less than 3 times.

I have run the maintenance test, no issues found.

I have tried with.

APPLE:
Safari
Chrome
Firefox

Windows7:
IE 11
Firefox

Windows8:
IE11

The ONLY time I got it to work was on Windows with IE and all plugins/hooks disabled. It still was not working on the others.

Any ideas?

Thanks

Need more info. What is actually happening?

[weave]

Need more info. What is actually happening?

Nothing. The button is there but clicking it does nothing at all.

[alexm]

Have you tried all the following?...

1) Make sure the flash uploader is enabled in the Admin Control Panel

Options -> Message Attachment Options -> Asset Manager - Enable -> Select "Yes, Flash Upload by Default"

2) Make sure you are NOT using remote YUI

vBulletin Options -> Server Settings and Optimization Options

Use Remote YUI set to None

3) Clear your browser cache

4) Clear VB cache

Maintenance ->Clear system cache

Can you PM me a link to your forum and a test account with upload permission and I'll try to take a look?

[weave]

Have you tried all the following?...

1) Make sure the flash uploader is enabled in the Admin Control Panel

Options -> Message Attachment Options -> Asset Manager - Enable -> Select "Yes, Flash Upload by Default"

2) Make sure you are NOT using remote YUI

vBulletin Options -> Server Settings and Optimization Options

Use Remote YUI set to None

3) Clear your browser cache

4) Clear VB cache

Maintenance ->Clear system cache


Can you PM me a link to your forum and a test account with upload permission and I'll try to take a look?

Let me add the SWF back and will send you the PM with the logon info.

Thanks.

[weave]

Let me add the SWF back and will send you the PM with the logon info.

Thanks.

So now, for whatever reason, this is ALL working on my MAC.

I tested with:
Safari
Chrome
Firefox

And it all working.....but I did not do anything any different than before.

[Mickie D]

great work thank you!

[cloudfarmer]

woo hoo!! thankyou so much. To anyone else that is completely new at this sort of thing, you must delete your browser cache if using Chrome. I kept missing this step and it would not work.

using 4.2.2

[sstiller]

Many thanks! It works

[alexm]

Update - The problem seems to be in VB 4.2.2 itself, even when using the 0 byte version of Uploader.swf, the problem still exists.

VB 4.2 PL 1 seems to have broken this. With the modified version of uploader.swf, the images SEEM to work. While editing your message they show up in the post just fine. However... When you save the message, you only get a link to the attachment, not the image.

Anyone else seeing this? Anyone got a solution?

I just spotted this reply to your thread on vb.com

http://www.vbulletin.com/forum/forum/vbulletin-4/vbulletin-4-questions-problems-and-troubleshooting/4029478-vb-4-2-2-pl1-attachments-not-working-in-quickreply?p=4047539#post4047539

For anyone else experiencing this issue:
I figured out my issue. Under General Settings>Disable AJAX Features, I had "Disable problematic AJAX features" selected. When I went back and selected "Enable all AJAX features", the quick reply started working properly again.

[webducknj]

does this patch allow you to upload more than 10 files at a time as attachments?

thanks,
bart

[Zachery]

The number of files allowed to be uploaded at once (outside of having flash) is limited by a lot of factors.

[webducknj]

i've seen vb sites where uploads of 100 or more files is possible. so it's just a matter of finding the right developer to fix it?

suggestions/referrals appreciated.

and thanks for the reply.

[Zachery]

There are a lot of things that come into play with uploading lots of files. More than just the flash uploader.

[Jennifer2010]

New error: Latest version of FireFox appears to create the file selection dialogue behind all other windows after clicking the "Select Files" button. I've verified this on my end and all of my forum's members seem to experience this. Can anyone else verify and possibly provide a solution?

[Mark.B]

I'm on the latest Firefox and that isn't happening.

Try it with a default style.

[alexm]

I'm on the latest Firefox and that isn't happening.

Try it with a default style.

+1

I've just recommended the same thing in the OP's thread on vb.com

[alexm]

Actually, didn't you have a problem before relating to a custom style/button?

Bet your problem is there!

Problem resolved:
We have a custom "Upload Images" button that calls the same function as the insert image button does on the post editor. However, after we upgraded to 4.2.2 it must not be compatible. Thus, all we have to do now is find the new code and it should work (default vb style works perfect)

I can't remember where I found the old code:
<span class="cke_button">
<input type="button" style="height: 30px; width: 100px; font-size: 14px; margin-top: 15px;" a id="cke_38" class="cke_off cke_button_vbimage" onclick="CKEDITOR.tools.callFunction(77, this); return false;" onfocus="return CKEDITOR.tools.callFunction(76, event);" onkeydown="return CKEDITOR.tools.callFunction(75, event);" onblur="this.style.cssText = this.style.cssText;" aria-labelledby="cke_38_label" hidefocus="true" tabindex="-1" value="Upload Images">
</a>
</span>

Anyway it's not a server issue anymore, lol.

[z3r0]

New error: Latest version of FireFox appears to create the file selection dialogue behind all other windows after clicking the "Select Files" button. I've verified this on my end and all of my forum's members seem to experience this. Can anyone else verify and possibly provide a solution?

Yep, I've just noticed this myself.

Edit - It seems to be a bug in Firefox, a quick google turns up the XF guys working out a fix for their software here - https://xenforo.com/community/threads/upload-button-problems-in-ff.82898/page-3#post-832948

[tbworld]

Thanks for sharing some clarity on the subject. :)

[MrD]

Hi,
the Uploader are not Working about 5 days?
The other Time, it´s worked perfect.

vb 4.2.2 pl2

[alexm]

What's actually happening? If you just upgraded to PL2 did you remember to re-upload uploader.swf?

[MrD]

Hi,
the Window with the Files are not open. only the overlay window.
yes i upgrade to 4.2.2 and i re-upload the swf.

But now it works, after i clear my cache.
It?s Amazing :rolleyes:

[Lightly_Toasted]

Stopped working out of the blue, went back to ajax and a blank swf file and uploads began working again.

[ozzy47]

That is because in the latest 4.2.2. patch and 4.2.3 this is included in the vb core. :)

[dougdirac]

Does this patch still work or is it still needed after upgrading to 4.2.3 Beta?

[ozzy47]

IIRC, this is included in 4.2.2. pl2 and 4.2.3

[alexm]

For info

This patch is now included in 4.2.2 PL2/PL3/PL4 and 4.2.3/4.2.4/4.2.5 core downloads from vBulletin. If you are running 4.2.2 PL2 just check the version of uploader.swf you have as the earliest download package had the wrong version. I guess this is why uploader.swf was included again in the 4.2.2 PL3/PL4 patches just in case. It should be 7,410 bytes.

uploader.swf file hashes:

MD5: A2D3F12746C4552FA0757DB6D2D23F84
SHA1: 9F1A68F926BF3D9C9FF8848CB51561783A8A31FA

[patracy]

I tried this with my board 4.2.1, but the select files button does nothing?

[MrD]

Hi,
after the new flash update the Uploader don?t work :(

[Dragonsys]

Hi,
after the new flash update the Uploader don?t work :(

What version of VB are you using?

[MrD]

Hi,
Vb4.2.3PL2

After Right click at the Button (that the flash Menu is open) and another click at the Button the uploader works.