vb.org Archive

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   vBulletin 4.x Add-ons (https://vborg.vbsupport.ru/forumdisplay.php?f=245)
-   -   Miscellaneous Hacks - Patched Flash Uploader to Fix Known Exploits (https://vborg.vbsupport.ru/showthread.php?t=307008)

alexm 03-02-2014 11:07 AM

Quote:

Originally Posted by tom w (Post 2484432)
Being a paranoid security type, any chance of getting the source code for this replacement file? Since it doesn't come from either Yahoo or VBulletin (for whatever reason) I'm reluctant to trust files from a relatively unknown sources (though it's great people like to help) which could introduce other vulnerabilities that we'd never know about.

I would be happy to share the source with another developer if their suggestions/feedback helps the community as a whole, but how would you know if I've given you the correct source? And, also being a paranoid security type with a busy vB4 forum myself, how do I know you aren't looking for vulnerabilities to exploit yourself? :p

I think the easy answer is if you understand Flash it's very easy to decompile the SWF yourself and look at the source. That's basically what I did to get it working anyway. :D

If anyone does find an issue let me know and I'll do my best to incorporate a fix.

BirdOPrey5 03-02-2014 01:40 PM

Quote:

Originally Posted by tom w (Post 2484432)
Being a paranoid security type, any chance of getting the source code for this replacement file? Since it doesn't come from either Yahoo or VBulletin (for whatever reason) I'm reluctant to trust files from a relatively unknown sources (though it's great people like to help) which could introduce other vulnerabilities that we'd never know about.

FYI

There are many free flash / swf file decompilers online you can upload the .swf file and get the source yourself.

For example - http://www.showmycode.com

furnival 03-10-2014 04:34 AM

I belatedly upgraded to VB 4.22 and had to reinstall this afterwards. This should be incorporated into the next VB 4 release so that everyone doesn't have to reinstall this once more.

msnhockey 03-12-2014 04:50 AM

I cant seem to get this to select more than 1 image in IE or Chrome with the settings in the instructions and with deleting browser cache. any ideas?

I am using IE 11 and Chrome version 33.0.1750.146

Zachery 03-12-2014 09:20 AM

Quote:

Originally Posted by furnival (Post 2486162)
I belatedly upgraded to VB 4.22 and had to reinstall this afterwards. This should be incorporated into the next VB 4 release so that everyone doesn't have to reinstall this once more.

there are no plans to add the flash uploader back, in any form, at this time.

joeychgo 03-14-2014 10:56 PM

Quote:

Originally Posted by Zachery (Post 2486640)
there are no plans to add the flash uploader back, in any form, at this time.


Zack, is there any reason to think this fix doesn't solve the problem? If not, then why not add it back with this fix?

BirdOPrey5 03-14-2014 11:40 PM

Quote:

Originally Posted by joeychgo (Post 2487314)
Zack, is there any reason to think this fix doesn't solve the problem? If not, then why not add it back with this fix?

Legal reasons...

Zachery 03-15-2014 12:55 AM

Quote:

Originally Posted by joeychgo (Post 2487314)
Zack, is there any reason to think this fix doesn't solve the problem? If not, then why not add it back with this fix?

It may solve today's problems, but not tomorrow, or the day after, or the day after.

There have been a long and sordid history with the flash uploader, and YUI's security of flash scripts. The YUI devs themselves have abandoned the script.

We can address the changes with something like relying on the HTML5 constructs of modern browsers instead by adding a simple MULTIPLE line to the input. That'd be the fix we'd go with, without adding another issue into the mix.

tbworld 03-15-2014 09:05 AM

Thanks @Zachery, nice explanation. Always appreciated. :)

Reef Man 03-25-2014 01:08 PM

It does not wolve the problem. I have 4.2.2

tpearl5 03-25-2014 02:05 PM

Quote:

Originally Posted by Reef Man (Post 2489453)
It does not wolve the problem. I have 4.2.2

You're right, it sounds nothing like an organ. But this patch does solve the problem of the flash uploader not working.

Jennifer2010 04-03-2014 08:24 PM

On 4.2.2 PL1, I get this error:

404 [IOErrorEvent type="ioError" bubbles=false cancelable=false eventPhase=2 text="Error #2038"]

It happens every time an image is uploaded, regardless of image size, format, dimensions or file name. After selecting the image to upload and then clicking upload, the progress bar completed and then the red arrow appears next to the file which when hovered, shows that error.

We don't have security software installed on the server and the max fliesize limit within VB and in php/mysql is over 100MB (vb's restriction is 1MB per file but we've tried as low as 10kb and it reports the error shown above).

Any help is appreciated.

ForceHSS 04-03-2014 08:31 PM

Quote:

Originally Posted by Jennifer2010 (Post 2491250)
On 4.2.2 PL1, I get this error:

404 [IOErrorEvent type="ioError" bubbles=false cancelable=false eventPhase=2 text="Error #2038"]

It happens every time an image is uploaded, regardless of image size, format, dimensions or file name. After selecting the image to upload and then clicking upload, the progress bar completed and then the red arrow appears next to the file which when hovered, shows that error.

We don't have security software installed on the server and the max fliesize limit within VB and in php/mysql is over 100MB (vb's restriction is 1MB per file but we've tried as low as 10kb and it reports the error shown above).

Any help is appreciated.

http://www.vbulletin.com/forum/forum...t-upload-photo

Jennifer2010 04-03-2014 08:50 PM

Quote:

Originally Posted by ForceHSS (Post 2491252)

Doesn't help. Blames it on server settings, which is why I mentioned in my comment that we don't have security software installed and our php settings aren't restricting anything.

Are we supposed to have anything for custom YUI path? Currently it's set to "none" (no Google/Yahoo library) and the path is blank beneath that.

Zachery 04-04-2014 06:23 AM

So, to deconstruct the error:

404 [IOErrorEvent type="ioError" bubbles=false cancelable=false eventPhase=2 text="Error #2038"]
This is the status of the page returned, 404 after the uploaded completed.

This is the error flash returned, which says IO error. This is a super generic, Input/Ouput error thrown by flash. More or less the file wasn't there, when it was done uploading.

This is a server issue, and the problem is your server. Some security, or other server setting is blocking the flash uploader from working, period.

mod_security
suhosin
A module of selinux
Anti(malware/virus) scanners
reverse proxies
bad upload configuration
An internal server error may even be hiding the real error message.


If you disable the flash uploader, to use the ajax one instead, does it work? Yes/No
If you disable the asset manager for the legacy uploader, Does it work? Yes/No

Does the AdminCP > Maintenance > Diagnostics > Upload File test work? Yes/No

Jennifer2010 04-04-2014 07:48 PM

mod_security - Not installed
suhosin - Not installed (using suexec)
A module of selinux - Not installed
Anti(malware/virus) scanners - Not installed
reverse proxies - We're using NGINX?
bad upload configuration - Not sure what this correlates to.

If you disable the flash uploader, to use the ajax one instead, does it work? Yes/No
One image at a time works. Multiple files selected results in the images not being inserted into the post. (one image at a time does not work on flash uploader)

If you disable the asset manager for the legacy uploader, Does it work? Yes/No
One image at a time works. Multiple files selected results in the images not being inserted into the post.

For example, I upload two different images one at a time and it works. If I select both of them and try to insert them, they fail and neither are inserted.

Does the AdminCP > Maintenance > Diagnostics > Upload File test work? Yes/No
Yes

file_uploads: On
open_basedir: None
safe_mode: Off
upload_tmp_dir: /tmp
upload_max_filesize: 100.00 MB

No errors occurred while opening the uploaded file for reading.

What should my image storage directory permissions be?


Thank you

Jennifer2010 04-04-2014 09:31 PM

Problem resolved:
We have a custom "Upload Images" button that calls the same function as the insert image button does on the post editor. However, after we upgraded to 4.2.2 it must not be compatible. Thus, all we have to do now is find the new code and it should work (default vb style works perfect)

I can't remember where I found the old code:
<span class="cke_button">
<input type="button" style="height: 30px; width: 100px; font-size: 14px; margin-top: 15px;" a id="cke_38" class="cke_off cke_button_vbimage" onclick="CKEDITOR.tools.callFunction(77, this); return false;" onfocus="return CKEDITOR.tools.callFunction(76, event);" onkeydown="return CKEDITOR.tools.callFunction(75, event);" onblur="this.style.cssText = this.style.cssText;" aria-labelledby="cke_38_label" hidefocus="true" tabindex="-1" value="Upload Images">
</a>
</span>

Anyway it's not a server issue anymore, lol.

camoit 04-11-2014 05:16 AM

Worked for me V4.1.12
it's a shame VB won't fix the problem. I guess they want to sell new versions.

Zachery 04-11-2014 05:32 AM

Quote:

Originally Posted by camoit (Post 2492590)
Worked for me V4.1.12
it's a shame VB won't fix the problem. I guess they want to sell new versions.

So, you're just going to ignore what we've already commeted on?

We have other fixes, it just wont' be the flash uploader.

MySaltyreef 04-13-2014 03:16 PM

you sir are a legend ! working perfectly on 4.2.2

K!nG 04-13-2014 09:34 PM

Not working for me on 4.2.2 Patch level 1. Yes i also have flash upload enable in admincp. Any help ?

Thanks.

ForceHSS 04-13-2014 09:47 PM

Quote:

Originally Posted by K!nG (Post 2493046)
Not working for me on 4.2.2 Patch level 1. Yes i also have flash upload enable in admincp. Any help ?

Thanks.

explain the steps you took after downloading the plugin

K!nG 04-14-2014 12:35 AM

After downloading i extracted the file to my desktop then i replaced the one i had and after that i checked into admincp to Make sure the flash uploader is enabled.

Now when i try to post an image from desktop by clicking on Inset Image icon, pop up comes and select from computer and when i click on Select Files nothing happens. It doesn't do anything.

ForceHSS 04-14-2014 03:08 AM

Quote:

Originally Posted by K!nG (Post 2493053)
After downloading i extracted the file to my desktop then i replaced the one i had and after that i checked into admincp to Make sure the flash uploader is enabled.

Now when i try to post an image from desktop by clicking on Inset Image icon, pop up comes and select from computer and when i click on Select Files nothing happens. It doesn't do anything.

So you logged into your ftp and when to clientscript/yui/uploader/assets
Folder and uploaded the uploader.swf file you mean?
Then when to your admincp/Options -> Message Attachment Options -> Asset Manager - Enable -> Select "Yes, Flash Upload by Default

K!nG 04-14-2014 07:44 PM

Yes & Yes. Did exactly what was in instructions and what you just mentioned above, but nothing happened.

ForceHSS 04-14-2014 07:45 PM

disable all plugins via config then test

Zachery 04-14-2014 09:24 PM

Quote:

Originally Posted by K!nG (Post 2493163)
Yes & Yes. Did exactly what was in instructions and what you just mentioned above, but nothing happened.

Does AdminCP > Maintenance > Diagnostics > Upload Test works?
ARe you using local, or remote YUI under the Server Settings / Optimization Options?

K!nG 04-14-2014 10:44 PM

Quote:

Originally Posted by ForceHSS (Post 2493164)
disable all plugins via config then test

I just disabled all plugins via config and nothing happened. Still not working. When i try to click on "Select Files" nothing happens.

K!nG 04-14-2014 10:49 PM

Quote:

Originally Posted by Zachery (Post 2493173)
Does AdminCP > Maintenance > Diagnostics > Upload Test works?
ARe you using local, or remote YUI under the Server Settings / Optimization Options?

Here is what i got in diagonstics>Upload test.

https://vborg.vbsupport.ru/external/2014/04/34.jpg

I am using Remote YUI.

Zachery 04-14-2014 11:39 PM

You can't use a REMOTE YUI, you have to use a local one. The SWF uploader on google/yahoo's servers have been removed.

K!nG 04-15-2014 01:58 AM

Quote:

Originally Posted by Zachery (Post 2493194)
You can't use a REMOTE YUI, you have to use a local one. The SWF uploader on google/yahoo's servers have been removed.

So basically this means i should upload the attached file and change it to local and it should work or should i just upload the empty file and change it to local ???

K!nG 04-15-2014 02:31 AM

Quote:

Originally Posted by Zachery (Post 2493194)
You can't use a REMOTE YUI, you have to use a local one. The SWF uploader on google/yahoo's servers have been removed.

Hi Zachery,

Even after selecting NONE i am still not able to get it done. When i click on "Insert image" nothing happens.

Zachery 04-15-2014 02:42 AM

What browser?

K!nG 04-15-2014 03:43 AM

Using google chrome.

K!nG 04-15-2014 03:47 AM

Since u asked for browser , I just checked it in IE and it's working fine. I only use chrome and it was working fine, but all of sudden it's not.

Toorak Times 04-18-2014 09:27 AM

For some reason a lot of my plugins will not even appear in Google Chrome but appear in Firefox and Safari no probs

rharbison 04-19-2014 06:45 PM

Update - The problem seems to be in VB 4.2.2 itself, even when using the 0 byte version of Uploader.swf, the problem still exists.

VB 4.2 PL 1 seems to have broken this. With the modified version of uploader.swf, the images SEEM to work. While editing your message they show up in the post just fine. However... When you save the message, you only get a link to the attachment, not the image.

Anyone else seeing this? Anyone got a solution?

alexm 04-25-2014 01:47 PM

Quote:

Originally Posted by K!nG (Post 2493223)
Since u asked for browser , I just checked it in IE and it's working fine. I only use chrome and it was working fine, but all of sudden it's not.


a) Upload the modified SWF file and make sure the flash uploader is enabled in the Admin Control Panel

Options -> Message Attachment Options -> Asset Manager - Enable -> Select "Yes, Flash Upload by Default"

b) vBulletin Options -> Server Settings and Optimization Options

Use Remote YUI set to None

c) Close your forum page and clear your browser cache - a lot of the issues where clicking the upload button does nothing is due to browser caching issues

Hopefully this helps!

alexm 04-25-2014 01:56 PM

Quote:

Originally Posted by rharbison (Post 2493864)
Update - The problem seems to be in VB 4.2.2 itself, even when using the 0 byte version of Uploader.swf, the problem still exists.

VB 4.2 PL 1 seems to have broken this. With the modified version of uploader.swf, the images SEEM to work. While editing your message they show up in the post just fine. However... When you save the message, you only get a link to the attachment, not the image.

Anyone else seeing this? Anyone got a solution?

I can't replicate this I'm afraid. I'm using 4.2.2 PL1 too and everything seems to work just fine. I'm using the standard, unmodified editor with asset manager and attachments work both via asset manager and in quick reply.

rharbison 04-26-2014 01:17 AM

OK, so here's the odd thing. I run about 6 forums (yes, all licensed). All are, as far as I know, the same. All are running V 4.2.2 PL1. One of the forums is having a problem with the attachments not showing up inline. It's reproducible, but also somewhat random.


All times are GMT. The time now is 04:56 PM.

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.01339 seconds
  • Memory Usage 1,841KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (19)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (2)pagenav_pagelink
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (40)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 

Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • pagenav_page
  • pagenav_complete
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete