Avoid .php in [IMG]

[account8226]

Hello, I would like help about a famous bug that happen on any forum software.

That bug is the following :
- A user made a PHP pages on his own server, that steel any visitor's IP adress.

That user embed that pages in BB Code.

So, is there a way to forbid for example .php codes. Is there a way to fix that withou disabling the whole IMG BB Code.

Regards.

 

[ragtek]

even if you forbid php files, the "bad boy" could use htaccess to rewrite the url

http://davidejones.com/blog/1126-creating-dynamic-signature-image-php/

also "normal images" like

can be used to get your ip address, because it's saved it the server log

 

[Jake Bunce]

The problem is that limiting the file extension for IMG locations doesn't protect you. A gif extension can be rewritten to a PHP script. There is no way to protect against this without disabling the IMG tag entirely which requires an addon.

edit - ninjaaaa

 

[dieketzer]

for example, the url http://gotvirtual.net/dynamic/banner.png is not graphic at all. its actually a directory. http://gotvirtual.net/dynamic/banner.png/index.php is a script that serves up a random graphic each load. there is really no way to know or easily defeat it from occurring that i am aware of, outside of blacklisting my domain.

 

[Floris]

You don't need to put it in a directory, you can just have a signature.gif that's actually a php file, which stores referrer data to a database, and spit out the real signature.gif. None the wiser.