[Ben0815] ImageProxyServer

[Ben0815] ImageProxyServer 1.1

No permission to download
Overview History Discussion
Ben0815

Ben0815

Member
Ben0815 submitted a new resource:

[Ben0815] ImageProxyServer - Extends the image proxy by Xenforo to use a remote server

This addon expends the image and link proxy by XenForo. It will proxy all images through a remote server and will therefore hide your server IP address in addition to your users IP addresses.
It will do nothing when you don't enable "Proxy images" in your ACP.

Installation:
  • upload the content of the upload directory to your forum
  • set a ImageProxyServer key
  • edit the variable "$key" in "server.php"
  • upload the "server.php" to the remote server
  • set the...
Click to expand...

Read more about this resource...
 
@Ben0815 Please can you add option Ignore https images/link? Option Ignore HTTPS Images, Choose to ignore https sourced images from the proxy process and instead let them be displayed from their origin location. Disabling image proxy for secure images.
 
" hide your server IP address in addition to your users IP addresses. "

Can you explain this a little? I just started using XF2 and have"proxy links and image" enabled.

When I hotlink an image to my forum, the URL does not show the server IP address or the user IP address, so I don't really understand why a remote proxy is needed.
 
The referrer contains the requester IP (user) - and the response contains the server IP. A proxy is able to hide both of these: the request will be tunneled through the proxy, hence it will show the proxy IP. Vice versa, the response is also tunneled through the proxy, so that one will be hidden aswell.
Usually, if you are not even using Cloudflare or some other kind of basic protection, you would not need this addon.
 
So the IP info is being passed in the background during the upload process? How would someone be able to view this info to cause a security concern? My site uses Cloudflare, so I wouldn't need this, correct?
 
ip-check.png


This image right here will normally show your IP address because the forum only passes the link to your browser. Then your browser is loading the image into your cache and will show you the pic. (somehow like that at least)

Now if you use the proxy mode by XF, your forum will cache all images on the server and will serve you the picture diretly. This means your IP wont get passed to "the bad guys".

Now, because the server actually has to cache the image - now the server IP address would be shown there. However, if you fear DDoS attacks and more, you dont want to reveal your servers IP address. Therefore this addon will pass all requests to a proxy server which then loads the images and passes them to your server.
So the "bad guys" only get the proxy image server IP, attacking this IP will prevent your server to cache new images (already cached ones still work of course), but your server will not be touched otherwise.

//Edit: The image above actually shows the server IP address Xenforo uses to host this forum because they use their proxy function. If you click "reply", the address will change to your own IP. -> To prevent revealing the server IP, you use my addon.
 
mikez006 said:
So the IP info is being passed in the background during the upload process? How would someone be able to view this info to cause a security concern? My site uses Cloudflare, so I wouldn't need this, correct?
Click to expand...
If you are concerned about your server IP getting leaked, you should set up a proxy server because Cloudflare does not prevent the in-built image proxy from leaking your server IP. But as Ben0815 said, if DDoS is none of your concerns, then you won't need that.
 
Can this be expanded to work with the link proxy part? It seems this only works for the Images.

(Also, for anyone who is curious, the server.php file for the remote server is located inside the addon zip file)
 
php 7.2.11

Code: 
Error: Function name must be a string src/addons/Ben0815/ImageProxyServer/XF/Service/ImageProxy.php:11
Generated by: Unknown account Oct 11, 2019 at 2:44 PM
Stack trace
#0 src/XF/Service/ImageProxy.php(93): Ben0815\ImageProxyServer\XF\Service\ImageProxy->fetchImageDataFromUrl('http://ip-check...')
#1 src/XF/Service/ImageProxy.php(47): XF\Service\ImageProxy->fetchNewImage('http://ip-check...')
#2 src/XF/Proxy/Controller.php(120): XF\Service\ImageProxy->getImage('http://ip-check...')
#3 proxy.php(34): XF\Proxy\Controller->outputImage('http://ip-check...', 'ab9b9cc525835ad...')
#4 {main}
Request state
array(4) {
  ["url"] => string(95) "/proxy.php?image=http%3A%2F%2Fip-check.org%2Fip-check.png&hash=ab9b9cc525835adc8f66115fc354aa0f"
  ["referrer"] => string(50) "https://www.example.com/threads/test.5300/"
  ["_GET"] => array(2) {
    ["image"] => string(32) "http://ip-check.org/ip-check.png"
    ["hash"] => string(32) "ab9b9cc525835adc8f66115fc354aa0f"
  }
  ["_POST"] => array(0) {
  }
}
 
You must log in or register to reply here.
Back
Top Bottom