Urgent Fix needed, [img] tag abuse

[cheat-master30]

Originally Posted by Lynne

Under bvoptions > Message Posting and Editing Options, make sure to set this to No:
Allow Dynamic URL for [IMG] Tags
With this option set to 'no', the [IMG] tag will not be displayed if the path to the image contains dynamic characters such as ? and &. This can prevent malicious use of the [IMG] tag.

That isn't going to help if they're using vB SEO, like in the example which gives 'static' URLs for pages without the IDs and stuff. I think vBulletin should implement a filter which checks if it ends with a valid file extension to stop this problem.

[Marco van Herwaarden]

Not 100% sure but i think this setting has been removed as it doesn't really serve a purpose anymore. Even a (seemingly) static link can lead to dynamic content.

Checking for fileextensions also does not help, i can easily create a .htaccess redirect that will turn a static link (www.site.com/image.jpg) to redirect to a php-script.

PS Search the 3.7 forums (and the bug tracker) on vB.com for 'Dynamic' and you will find a few posts where this is explained/discussed.