vb.org Archive
Page 3 of 4 12 3 4
Show 40 post(s) from this thread on one page

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   vBulletin 4.x Add-ons (https://vborg.vbsupport.ru/forumdisplay.php?f=245)
-   -   Miscellaneous Hacks - Asset Manager / Image Upload Fix to upload multiple files like the Flash uploader (https://vborg.vbsupport.ru/showthread.php?t=306915)

BirdOPrey5 01-13-2014 11:26 AM
GREAT NEWS!

http://www.vbulletin.com/forum/forum...57#post4015757

The vBulletin.com user alexm has managed to re-compile the uploader.swf file with this exploit (and another) fixed!

He has uploaded a new .zip file with a new uploader.swf file to the post I linked to above.

This file is a direct replacement for uploader.swf and you can upload it over your current uploader.swf file and go back to the flash uploader!

Warning: alexm admits he is not a flash developer and there is no guarantee additional exploits don't exist- but it looks good to me.

DemOnstar 01-13-2014 11:37 AM
For those of us that are lazy.. Here's the jist of it.

http://www.vbulletin.com/forum/forum...57#post4015757

Quote:
Following my last post I think I've managed to fix the flash file... The problem was with the decompiled source. I managed to find the original Actionscript source code for YUI 2.9.0 here:

https://github.com/yui/yui2/tree/master/src/uploader/as

I used that to replace some of the decompiled source from uploader.swf and then recompiled with a REGEX to sanitise allowedDomain. The result is a working uploader.swf that passes the exploit proof of concept.
Code:
uploader.swf?allowedDomain=\%22}%29%29%29}catch%28e%29{alert%28document.domain%29;}//
Quote:

If there are any proper Flash developers out there who can double check my code I will be happy to share the source!

DISCLAIMER: I am not a flash developer, I am just another vBulletin customer trying to keep his members happy! This file is provided free of charge for the benefit of the vBulletin community. You use it at your own risk! Please test before using on a live site!!
Download:

djbaxter 01-13-2014 11:37 AM
That's the problem: How many Flash exploits have there been over the past year alone? I applaud Alex for his efforts but he found another security vulnerability a day after he released his version. For some time, it appeared that Adobe was releasing a new version of Flash every month or so.

I think most people are going to be better off with a non-Flash solution.

From alexm at http://www.vbulletin.com/forum/forum...81#post4015881

Quote:
Unless anyone else can find any further problems which need fixing I'm not intending to develop it further. The .zip file posted earlier contains a working uploader.swf with the allowedDomain exploit fixed plus another potential exploit also fixed so those who want to stick with the flash uploader are now able to return the functionality back to exactly what it was before all this started, which was the main goal of this exercise.

hugh_ 01-14-2014 09:35 AM
Thanks Joe.

BirdOPrey5 01-14-2014 11:44 PM
Alexm released it here on vBulletin.org as a mod now: https://vborg.vbsupport.ru/showthread.php?t=307008

Please be sure you nominate it MOTM if you like it, I did. :up:

weave 04-27-2014 11:58 AM
Have been having issues with 4.2.2 PL1 and the patched SWF so I found this and gave it a go.

THANK YOU!!!!

Flash just needs to be declared DEAD so we can all move on from it.*

TransAmDan 06-18-2014 06:47 AM
Brilliant fix, I've been using it for many months now. We run an American and Classic car club, and we have many photos of events we have attended, could be up to 1000 photos to upload.
A few years ago, I remember just setting up there 1000 to upload and leaving it. However after about 50 the gap between uploads gets greater. Therefore slowing to almost a halt at 100. I dont think it is the change of this fix, but something else that has crept in. Has anyone else noticed this?
I wonder if that is fixable. I've never tried SWF coding, my area is AVR assembler, ASP, VB or C++.

BirdOPrey5 06-19-2014 12:12 PM
Quote:
Originally Posted by TransAmDan (Post 2502432)
Brilliant fix, I've been using it for many months now. We run an American and Classic car club, and we have many photos of events we have attended, could be up to 1000 photos to upload.
A few years ago, I remember just setting up there 1000 to upload and leaving it. However after about 50 the gap between uploads gets greater. Therefore slowing to almost a halt at 100. I dont think it is the change of this fix, but something else that has crept in. Has anyone else noticed this?
I wonder if that is fixable. I've never tried SWF coding, my area is AVR assembler, ASP, VB or C++.
This fix doesn't use flash/swf coding at all- it is the built in HTML/Javascript powered uploader. If the same slowness affects both the AJAX and Flash uploader than the problem is with the server not the SWF file. Frankly 50 or 100 or more files were never intended to be uploaded at once. vBulletin isn't gallery software- it's forum software that allows images. I'm glad it is working out for you but no one ever tested uploading 1000 images.

TransAmDan 06-19-2014 04:52 PM
Quote:
Originally Posted by BirdOPrey5 (Post 2502606)
This fix doesn't use flash/swf coding at all- it is the built in HTML/Javascript powered uploader. If the same slowness affects both the AJAX and Flash uploader than the problem is with the server not the SWF file. Frankly 50 or 100 or more files were never intended to be uploaded at once. vBulletin isn't gallery software- it's forum software that allows images. I'm glad it is working out for you but no one ever tested uploading 1000 images.
I know what your saying. I tried it once and it worked, but now it doesn't seem to work as well. The difference is web server, and of course up to date vBulletin software now. My website used to be on a windows server, then i moved to shared Linux, now I'm on a dedicated Linux server. It seems I had better luck with uploading a mass of images when I was on windows, but then others things have changed since then in the last 3 years. so wasn't sure if it was something I could revert back.
I will carry on running tests, just wondered if anyone else noticed this.

chriske 07-08-2014 12:01 PM
Just to make sure, this solution is not based on flash? It is working like a charm, thank you so much!


All times are GMT. The time now is 11:38 PM.
Page 3 of 4 12 3 4
Show 40 post(s) from this thread on one page

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.01185 seconds
  • Memory Usage 1,751KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)bbcode_code_printable
  • (5)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (3)pagenav_pagelink
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (10)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 
Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • pagenav_page
  • pagenav_complete
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete