[jeremycs]

Originally Posted by Mysticales

My concern is.. I am not secure about using this.. seems users could spam flash players all over a thread.. =/ Wonder what everyone does to secure this.

There are definitely some security issues to consider when using this module.

#1: Think strongly about allowing macromedia files to be one of the file types that are allowed to play. (ie .swf and the other 2 in that row). It's very easy for someone to construct a .swf that will redirect your member to a url of the .swf authors choosing. Perhaps the site they redirect them to looks just like YOUR sites login page? Making the user think they are logged out and they need to log in again. But instead, the flash author harvests their password & logs them in to your board as if nothing happened.

#2: As mysticales says above, and I have said, and someone else originally said in this thread... there is potential for per-thread denial of service attacks. The attacker would just need to make a few posts and autoplay 20-30 large files.

Suggested fixes:

For #1: There's no fix really, unless your server pulls the submitted .swf or flash file on submission, scans it for anything you consider malicious, and then hosts it locally. Scanning a hotlinked .swf & leaving it that way would do no good because the person could just change the .swf file to something malicious later.

Btw, I'm think the same goes for certain windows media files as well... .asf and .asx I believe.

For #2: Add options to limit things like:

- The number of media tags a user can enter per day
- The number of media tag allowed per thread

And most importantly:

Ignore user-submitted autoplay? (YES) / NO