[3.2][3.3][BETA] Image Redirect

[v12mike]

For the sake of discussion and enlightenment, Amigo, can you tell us what harm a MITM attack can do on an image link in a typical phpBB forum context? Remember that the browser has been told to render the link content as an image.

Given the answer to that question, what action would you as a user take, if you were reading a phpBB forum over https but you get an insecure content warning for an image hosted on a http site?

[AmigoJack]

what harm a MITM attack can do on an image link in a typical phpBB forum context? Remember that the browser has been told to render the link content as an image

The picture's integrity. When it should display text in it, that could have been modified. When it should display persons, their faces could have been modified. Such things. Not security.

what action would you as a user take, if you were reading a phpBB forum over https but you get an insecure content warning for an image hosted on a http site?

My level in believing what I see: if I know it comes thru HTTP I could less trust it than when it comes thru HTTPS.

At least that's how I would do it from the other side: manipulate pictures in HTTP streams when someone is proxifying them as HTTPS. A board owner with malicious intentions has even less work to do, as then always his modified pictures are served instead of the originals (of course: this case applies to many other scenarios, like attachments being modified etc.).

[</Solidjeuh>]

Tried to install on Centos 7. After npm install I get this:



And where to add this:

Code: Select all

# redirection of /camo/ to the local proxy
    RewriteRule ^/camo/(.*)$ balancer://camo/$1 [P,L] 
    <Proxy balancer://camo>
        BalancerMember http://127.0.0.1:8081
    </Proxy>

[v12mike]

I think I had the coffee-script warning last time I did a reinstall, but it is only a warning and I ignored it. I was hoping that it would be fixed upstream by now.

The camo config for apache should go just under the </Directory> section corresponding to your phpBB site root directory. I can't identify which of your listed files that is in.

[</Solidjeuh>]

I think I had the coffee-script warning last time I did a reinstall, but it is only a warning and I ignored it. I was hoping that it would be fixed upstream by now.

The camo config for apache should go just under the </Directory> section corresponding to your phpBB site root directory. I can't identify which of your listed files that is in.

Found it, thank you

[kennyke]

Can it be, that this does not work on the 3.2.3 version ?
My forum is not yet updated completely, but i want to know if i have to change every image myself, or that this can be done automatically.

Thanks in advance

[v12mike]

I don't understand your question.

This extension works on all 3.2.x versions of phpBB (to be honest I have not tested with 3.2.8 yet, but see no reason that it should have broken).

It does require that the phpBB database upgrade corresponding to the introduction of th S9E parser into phpBB is completed successfully. I had a forum where this database upgrade had been aborted, and although the forum otherwise seemed to run normally, this extension would not work.

Tell us exactly what problem you are having and which version(s) of phpBB you are using.

[KYPREO]

I seem to be having trouble getting the extension to display my images from harvested store.

As noted elsewhere, scripts ran beautifully and I have harvested almost 80,000 images to date (just from Photobucket). I have also harvested all avatars and signature images and moved them to the images/ext/ directory.

Extension was able to be installed and enabled from the ACP correctly.

Local Image Store Path is set to enabled.

The local image store path is set to "images/ext/".

The permissions in http://www.host.com/images/ext/ appear to be correct. For example, I can manually access the local store by calling up by the MD5 filename and accessing the expected URL of the replacement image from within any browser. Looking at the settings in IIS, they look right and all the correct MIME types are configured and take inheritance from other image folders which work normally.

However, images within the forum are being served from their original location.

For example, taking the following post: http://www.ausrotary.com/viewtopic.php? ... 0#p2763190

This post remote links the image at http://i654.photobucket.com/albums/uu26 ... 3f0fe1.jpg

The expected local file should be at http://www.ausrotary.com/images/ext/f83 ... ae5a49.jpg

Lo and behold, it displays correctly, embedded below:



Forum v. 3.2.2
PHP v. 7.1.7

I have also tried purging the cache.

Any tips much appreciated.

[v12mike]

Which version of the extension have you installed?

In the Extension settings, is "Local Image Store Mode" shown as enabled?

Does it work correctly if you make a new post on your forum with the same PB image link?

Do you have any other extensions installed that manipulate the way that posts are displayed?

[KYPREO]

Which version of the extension have you installed?

The latest on the first post, v 2.0.0-b2

In the Extension settings, is "Local Image Store Mode" shown as enabled?

Does it work correctly if you make a new post on your forum with the same PB image link?

Unfortunately new posts are the same. I thought maybe I needed to run the phpBB BBcode cli reparser again. But if that was the case, wouldn't new posts display properly?

Do you have any other extensions installed that manipulate the way that posts are displayed?

Yes. See below list.

The most obvious candidate was phpBB Media Embed as that uses the s9e text formatter and external library to manipulate how URLs are displayed in posts. I disabled that extension and hard refreshed some pages but they were still serving externally hosted images.

[KYPREO]

Should any assets from the Image Redirect be identifiable when a page loads? From what I can tell looking at the code, it should.

Using Developer Tools in Google Chrome to look at the example page I listed above, I cannot see that any assets are called upon from forum/ext/v12mike/imageredirect. The raw page source doesn't refer to imagedirect either.

I have checked the permissions in the extension folder and they appear correct.

I have checked within the forum database itself and the Local Image Storage Mode setting is properly enabled ('imageredirect_localimagesmode' = 1).

[v12mike]

I just realised what the problem is.

I fairly recently updated the harvesting scripts to add the original filename extension to the harvested files (which helps browsers understand some files) and I updated the extension at the same time, but I forgot the label and release the new version of the extension, and you have downloaded the previous version.

Try installing: https://github.com/v12mike/imageredirec ... 0.1-b1.zip

[KYPREO]

I just realised what the problem is.

I fairly recently updated the harvesting scripts to add the original filename extension to the harvested files (which helps browsers understand some files) and I updated the extension at the same time, but I forgot the label and release the new version of the extension, and you have downloaded the previous version.

Try installing: https://github.com/v12mike/imageredirec ... 0.1-b1.zip

And it works!

Brilliant work. Tested on a few pages and all smooth sailing so far. The avatars and signature images I scraped all work as well.

My sincerest thanks

[v12mike]

You are welcome.

And just to be clear, the current version of this extension is now v2.0.1-b1 https://github.com/v12mike/imageredirec ... 0.1-b1.zip

I intend to implement some minor corrections and submit this for phpBB approval in the near future.

[v12mike]

I have just updated the requirements fields for this extension so that it will install correctly on phpBB 3.3.0

The new version is 2.0.1-b2 Note that this is now superceded, see later post.