vb.org Archive
Page 1 of 5 1 23 Last »
Show 40 post(s) from this thread on one page

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   vB3 General Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=111)
-   -   Excessive Smilies overloading Servers (https://vborg.vbsupport.ru/showthread.php?t=41281)

Kaelon 07-20-2002 03:12 AM
Excessive Smilies overloading Servers
 
One of my over-zealous (read: bored) users demonstrated an exploit / flaw in vB earlier this evening that I'd like to share with the rest of you to see if: (a) this has been solved; (b) there is a hack which corrects it; or (c) if any of you have come across the issues and have implemented a fix.

This applies to vBulletin 2.2.6, though I suspect it may apply to all previous versions as well.

Problem: When a user enters nothing but a bunch of smilies in the entire "Message:" field of a post, the server's load rises above 5.00 (much higher at times) while processing the smilies. The post is then not made, and the server executes a cold flush of the system RAM.

I've repeated this test several times, and the results seem fairly consistent. Flood a vBulletin with enough smilies and you can basically take it out of commission.

Possible Solution: Eliminate the use of smilies on the forums in question, or implement an algorithm that limits the number of smilies that a user can enter into the Message field. The question is - how exactly would one eliminate the smilies? Just remove them from the list of smilies in the vBulletin Control Panel?

Thoughts on this anyone?

Kaelon 07-21-2002 07:33 PM
No one is concerned about this? :p

Kaelon

FWC 07-21-2002 10:53 PM
Quote:
Originally posted by Kaelon
Possible Solution: ..., or implement an algorithm that limits the number of smilies that a user can enter into the Message field.
This is already built in to vB. It's in Posting code allowances in vBulletin Options in the admin cp.

Kaelon 07-22-2002 06:15 PM
That's incorrect. The vBulletin Posting Code Allowances section only permits limiting how one inserts smilies, not how many smilies one can have in the text. What we need to correct this flaw is a setting that would limit the maximum number of smilies (and run a check before the post is processed).

Quote:
Allow vB IMG code in signatures?

Allow vB code in signatures?

Allow smilies in signatures?

Allow HTML in signatures?

Maximum images per post/signature
Maximum number of images to allow in posts / signatures. Set this to 0 to have no effect.

Clickable Smilies per Row
When a user has enabled the clickable vbcode/smilies how many smilies do you want to show per row?

Clickable Smilies Total
When a user has enabled the clickable vbcode/smilies how many smilies do you want to display on the screen before the user is prompted to click for more.

Allow Dynamic URL for [img] tags?
If this is set to 'no', the [img] tag will not be displayed if the path to the image contains dynamic characters such as ? and &. This can prevent malicious use of the tag.

Allow vBcode Buttons & Clickable Smilies?
This global switch allows you to completely disable vBcode buttons and clickable smilies.

Xenon 07-22-2002 06:24 PM
Maximum images per post/signature
Maximum number of images to allow in posts / signatures. Set this to 0 to have no effect.

this affects also smilies

FWC 07-23-2002 05:54 AM
Quote:
Originally posted by Kaelon
That's incorrect. The vBulletin Posting Code Allowances section only permits limiting how one inserts smilies, not how many smilies one can have in the text.
Interesting. Then there is something wrong with your board. It does limit the number of smilies on my board and any other I've ever seen.

Kaelon 07-24-2002 08:56 PM
Quote:
Originally posted by Xenon
Maximum images per post/signature
Maximum number of images to allow in posts / signatures. Set this to 0 to have no effect.

this affects also smilies
Yep, but that doesn't solve the problem, because the smilies are still processed even before the post is rejected - taking up server resources. We need to figure out a way to pre-determine whether the number of smilies in the submitted text exceeds a certain number, before actually processing the thread and converting smilies into image links. The conversion process is surprisingly very server-intensive.

Kaelon

Xenon 07-24-2002 09:05 PM
when you click on send posting it'll be preparsed.
newreply.php:
PHP Code:
    // check max images
    if ($maximages!=0) {
      $parsedmessage=bbcodeparse($message,$forumid,$allowsmilie);
      if (countchar($parsedmessage,"<img")>$maximages) {
        eval("standarderror(\"".gettemplate("error_toomanyimages")."\");");
        exit;
      }
    } 
as you can see in functions.php:
PHP Code:
    while ($smilie=$DB_site->fetch_array($smilies)) {
      if(trim($smilie[smilietext])!="") {
        $bbcode=str_replace(trim($smilie[smilietext]),"<img src=\"$smilie[smiliepath]\" border=\"0\" alt=\"\">",$bbcode);
      }
    } 
this code runs just once for each sending process, so lets say if you have set 20 smilies this line
PHP Code:
        $bbcode=str_replace(trim($smilie[smilietext]),"<img src=\"$smilie[smiliepath]\" border=\"0\" alt=\"\">",$bbcode); 
is executet 20 times when someone sends a reply.
not really server intesive.

after that preparsing it counts the ammount of "<img" segments, and if its to high, the post is refused, it'll never be added to the post table so it wouldn't be added to the thread.

if your board doesn't use that behavor of checking max smilies you must have hacked it and made something wrong

Scott MacVicar 07-25-2002 01:02 AM
I think hes talking like 1000 smilies in one post and in that case he is correct.

Kaelon 07-25-2002 01:31 AM
Yes, that's right, PPN.

Basically, my server (which has 2 gigs of RAM, Dual P3's) doesn't even blink when a post has something like 20 or even 100 smilies. But, as I have tested personally, if you get a malicious user to come in and start spamming with a post of thousands of smilies - your server will basically come to a grinding halt.

The worst part about this, is that the post is not even processed after the server-intensive issue - so you can never figure out who it was that did this to you to take disciplinary sanctions against the abusive user.

Kaelon


All times are GMT. The time now is 11:02 AM.
Page 1 of 5 1 23 Last »
Show 40 post(s) from this thread on one page

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.04223 seconds
  • Memory Usage 1,750KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (3)bbcode_php_printable
  • (4)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (2)pagenav_pagelink
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (10)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 
Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • pagenav_page
  • pagenav_complete
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete