XF 1.5 Is There a Way to Make Image Proxy to Follow 301 Redirects?

[enivid]

I have image proxy enabled in my forum. When adding images through URLs that do 301 redirects, it shows a broken image icon. When testing the URL via Test Image Proxy tool, it gives the following output

<URL> could not be fetched or is not a valid image. The specific error message was: Received unexpected response code 301 (Moved Permanently)

Is there any way to make Image Proxy resolve 301 redirect URLs in XenForo?

 

[Mike]

The short answer is no. This was just changed as it's an important part of the security fix we released.

 

[enivid]

How does it undermine security?
Any plans to do anything with it?
It breaks a lot of images where image hosting has moved.

 

[Mike]

It is one of the mechanisms that can be used to exploit a SSRF, which can lead to remote code execution (https://xenforo.com/community/threads/xenforo-1-5-10-released-includes-security-fix.120218/).

We're very much aware that it's not ideal, but given the alternative, it had to be changed. We will look into options but changing this may not be viable.

 

[directodigital]

@Mike since this update a lot of hosts including imgur, gyzado, postimg, lightshot do not work with the image proxifier as they often redirect to a subdomain or different URL for the actual image, could you suggest any changes to make this work?

 

[dieg0]

Same problem here, its really annoying and messing hundreds/thousands of images on my site...

 

[Nuno]

Hi

Does this affects all XF versions?
I'm planning go to https in the coming months but this is very importa issue to deal with.

Thanks

 

[Mr Lucky]

Hi

Does this affects all XF versions?
I'm planning go to https in the coming months but this is very importa issue to deal with.

Thanks

I think it is just 1.5.10 (and presumably later)

 

[Mr Lucky]

http://i.imgur

@Mike since this update a lot of hosts including imgur, gyzado, postimg, lightshot do not work with the image proxifier as they often redirect to a subdomain or different URL for the actual image, could you suggest any changes to make this work?

Are the redirects a constant? ie if it is just http redirecting to https it is something you could batch change to the actual redirected URL using:

https://xenforo.com/community/resources/post-content-find-replace.1549/


For example, see this post:

https://xenforo.com/community/threads/post-content-find-replace.6548/page-57#post-1095415

change all

http://i.imgur

to

https://i.imgur

 

[enivid]

Hi

Does this affects all XF versions?
I'm planning go to https in the coming months but this is very importa issue to deal with.

Thanks

It's from 1.5.10, but it has nothing to do with moving your forum to HTTPS. It is about the redirects of the image hosting.

 

[Mr Lucky]

It's from 1.5.10, but it has nothing to do with moving your forum to HTTPS. It is about the redirects of the image hosting.

It is for sure related to switching you forum to https, because you will find that suddenly even with Proxy Image ticked, all those redirected images are going to show an error, so they do need to be dealt with if you intend to use any version from 1.5.10

When I switched to SSL, everything was fine until I did the upgrade to 1.5.10

 

[enivid]

I have switched to HTTPS on 1.5.10 and nothing changed in how the images were displaying - those that have been redirecting weren't showing before and aren't showing now, those that haven't been redirecting are still showing fine. I am using XF Proxy for images by the way.

PS: Of course, I have also updated my XF database to replace all internal links replacing "http://" with "https://".

 

[Nuno]

I'm not using 1.5.10 yet but I need this to work without issues.
My community lives from photos.

 

[Mr Lucky]

You can see the issue on this forum.

For example there are broken images in the post here:

https://xenforo.com/community/threads/semantic-html.892/

But if you reply to that post you will see the images fine in the post editor.

 

[Nuno]

But if you reply to that post you will see the images fine in the post editor.

Thanks

I tested this in my board and of course it doesn't work too since I applied the patch

We will look into options but changing this may not be viable.

Reading @Mike words, what can we expect in the near, very near future? I can't change my site to https knowing some images will be gone!

 

[Amin Sabet]

Reading @Mike words, what can we expect in the near, very near future? I can't change my site to https knowing some images will be gone!

You can change to https without enabling the image proxy. That's what I did, and the mixed content warnings have gone largely unnoticed.

 

[Nuno]

I have made some replacements to url from images that redirects to https.

Eventually this will be a cat and mouse job

 

[Mr Lucky]

I have made some replacements to url from images that redirects to https.

Eventually this will be a cat and mouse job

This may be a good solution:

https://xenforo.com/community/resources/convert-image.2521/