UK Online Safety Regulations and impact on Forums

The not so good news is, some of them do have full GPS data. Having converted them to jpegs, I uploaded them here

sitecam.io

Free Photo EXIF Metadata Viewer | SiteCam

Free tool to view EXIF metadata from your photos. Select your image and instantly see detailed information like GPS coordinates, camera model, date, and more.
sitecam.io sitecam.io

And while they mostly say no exif data, there are still quite a lot that have either partial GPS info or full GPS location info. (It seems to be the ones taken with a "proper" camera that have it. The majority, taken with phones, don't have it).

So looks like I still need exif data stripping. So much for photoshop info - which didn't find any.

I think that online tool linked above, actually uses exiftool.

Incidentally, what is GPSInfoIFDPointer? That has a number next to it, but it isn't a GPS location. Some only have that. Some have full GPS location (latitude and longitude).
 
I suppose if I could get exiftool to work, I could presumably tell it to remove all GPS data? But that would only be on the downloaded files - not the ones within the server.
 
I asked the server bot how to remove it and got this

"To remove EXIF GPS data from attachments in PHP, you can use the exif_read_data() function to read the EXIF data and then overwrite or remove the GPS data. Here's a simplified approach:

Use PHP's exif_read_data() function to extract EXIF data from the image file.Modify the EXIF data to remove or overwrite the GPS information.Save the modified image back without the EXIF data using libraries like GD or ImageMagick.
Example:



<span>$imagePath</span> = <span>'path/to/your/image.jpg'</span>;<br><span>$image</span> = <span>imagecreatefromjpeg</span>(<span>$imagePath</span>);<br><br><span>// Remove EXIF data by re-saving the image</span><br><span>imagejpeg</span>(<span>$image</span>, <span>$imagePath</span>, <span>100</span>);<br><span>imagedestroy</span>(<span>$image</span>);<br><br><span>echo</span> <span>"GPS data removed."</span>;<br>

This process removes all EXIF data, including GPS. For more advanced control, consider using the ImageMagick library."
 
Alvin63 said:
Incidentally, what is GPSInfoIFDPointer? That has a number next to it, but it isn't a GPS location. Some only have that.
Click to expand...
I would guess (and it is a guess) that it's probably an offset indicating where in the data the GPS data is. So pointers in computer term - well point to something, so it's probably saying - go to such and such position to find this data. I'd not worry too much about it.
 
What's annoying is there is a fair smattering of photos with full GPS location data. Olympus seems to be the culprit. But I'll probably need to do something to remove all exif data just to clear those.
 
chillibear said:
My own tool uses exiftool to do the removing, I'm a bit more specific in that I only remove the location metadata with -location:all= rather than everything. You'll find however if you just go ahead and strip the data you break the attachments very quickly. They are named for the MD5 hash of the file - which would be different after the file has been edited by exiftool so really you need to update the xf_attachments_data table and rename the data file and thumbnail appropriately as I think (and it's been a while since I checked) that XF does check the hash before displaying the file - so if there is a miss-match you wont get an image shown.

You could safely use exiftool however to see if you have anything with location metadata encoded in it by running exiftool, for example lets assume you had your XF install at /var/www/forum.example.com and the directory structure is standard. You might for instance run exiftool -location:all -G -a -j /var/www/forum.example.com/internal_data/attachments/6/*.data In that example I'm just scanning one directory (6) - you'll find numbered directories in the internal_data/attachments directory - they are named for data_id of each upload. I expect if I tried to scan all the directories the argument list would be too long (best use find to process the whole lot) so it seemed silly to suggest that as an example. Anyhow that would kick out results in JSON format, which would look something like:
JSON: 
{
  "SourceFile": "internal_data/attachments/6/6269-4c3e3cc924b72acc7bf11357fb1546a4.data"
},
{
  "SourceFile": "internal_data/attachments/6/6270-d732e4806c17c4d635d53c30189dc383.data",
  "MakerNotes:Location": "",
  "MakerNotes:Country": "",
  "MakerNotes:State": "",
  "MakerNotes:City": "",
  "MakerNotes:Landmark": "",
  "MakerNotes:City2": ""
}
So the first file there has no location data, the second one has location data, although it's all blank in that example.

So that's a long winded way of saying, yes you can use exiftool, but you need to be careful and know what you're doing with the XF data structure.
Click to expand...
So if I can work out how to get exiftool installed and running, could I do something like this, within the server, to remove the metadata in the internal_data/attachments folder?
 
In theory yes. That's essentially what the tool I started to write does (I just need to do a bit more testing before trying it out on actual data! Then there were a few extra features I wanted to add). I was pretty sure however when I first just tried just using exiftool I broke the attachments - I'd assumed that was because the file was altered and the hash no longer matched, but just testing by swapping some files this evening didn't seem to break things, so maybe I was wrong about that, I guess checking the XF source code would reveal what is done. I need to sit down and systematically run through some tests I think to confirm what I thought must be happening.
 
What is the best way to back up the attachments file in internal_data in public_html? Can I just copy the folder and contents and put it somewhere else? (as in where?) :-) I'm thinking of asking the server to help me delete the exif data. Although it'll probably be their bot.

But thought having the file backed up first might be a good idea! Presumably I can just put the back up copy back if I mess up? Or is it not that simple? 🤣
 
chillibear said:
In theory yes. That's essentially what the tool I started to write does (I just need to do a bit more testing before trying it out on actual data! Then there were a few extra features I wanted to add). I was pretty sure however when I first just tried just using exiftool I broke the attachments - I'd assumed that was because the file was altered and the hash no longer matched, but just testing by swapping some files this evening didn't seem to break things, so maybe I was wrong about that, I guess checking the XF source code would reveal what is done. I need to sit down and systematically run through some tests I think to confirm what I thought must be happening.
Click to expand...
Thank you. Posted at the same time :-) There is plenty of info online about how to remove GPS data with exiftool, but that's for computer files, not files stored in a server.
 
Alvin63 said:
But thought having the file backed up first might be a good idea!
Click to expand...
Yes if you are going to alter them take a copy! Absolutely you want backups!
Alvin63 said:
how to remove GPS data with exiftool, but that's for computer files, not files stored in a server.
Click to expand...
Files are files. Nothing special about servers! Well he says that, but granted my servers do have slightly more robust kit in than your home PC in general, but then again that's to avoid the need for too many trips to the data centre, less faff if you've only got to go to the office/bedroom/whatever to swap out a failed fan/psu/drive/whatever.
 
It's getting complicated 🤣 I backed up the folder. AI told me to create a new folder in public_html, which I did. Then gave me a script to paste in a text editor to strip data using GD Library, which I then uploaded into the new strip_exif file. Then said to type the url into a browser and it run and strip all the data. But I got a Forbidden 403 error. AI is then starting to talk about looking in .htaccess and see if there's something to change in there and I don't want to start messing with that .............So deleted the folder I'd created.

So I tried the server bot's option, which was to create a new file and paste some code and run it (after checking permissions). That gave an error code 500 server internal error. And the bot seems to have gone for lunch now and not speaking any more. So I deleted that file as well.

Tomorrow is another day.

It's a shame there isn't an addon just to strip exif data. Or some of it anyway.
 
Last edited:
Whilst large language AI models are impressive, ultimately they are just well adjusted word prediction - they don't actually "know", naive bayesian classifier if you like on steroids. I'm not sure I'd trust it to write code I then ran but didn't understand!

Assuming you are happy downloading and uploading files to your server via FTP (or similar) then you could get them (the attachments) all, process them locally on your desktop computer (if you can find a nice windows tool or get exiftool running locally okay) and then upload them again to replace those on the server. Remembering to take backups of course! That might be easier for you?
 
I wondered if it would be possible to do that but was slightly cautious about the idea of taking all the attachments off and re-uploading them in case they all ended up somehow in the wrong place on the site if some changes affected that or altererd the file numbers somehow.

I agree about not trusting AI coding :-) Hence doing the backup. Although presumably the server trusts it's own AI bot?!!

Somehow I'd rather do it while everything is in the right place on the server....but .........I'll see if I can get a spare laptop going to mess about with exiftool on it later. I already have copies of all the directories downloaded. Which is how I ran them through that online tool after converting to jpeg. But I'd need a "clean" copy of downloaded directories that I haven't messed with (ie converting to jpeg).

So presumably, if all the photo files stayed in their same directory folders, and removing exif didn't alter file numbers, then it "should" be ok to just replace the directories in the attachments folder, with the ones I've downloaded and edited (already have a back up in the server of the attachments folder).

Actually I did see a video about doing it in Windows, but it turned out it wasn't a full solution (ie I think it only removed ir when viewing on windows, not from the file fully or something like that).

Sorry I'm just thinking out loud here - I've spent a ridiculous amount of time on this. I was about to get the site going again in the next week and got stuck with this. On the other hand maybe I should wait in case more Child Risk Assessment stuff comes out and borks my CRA.

But - I think exiftool is the only real solution on Windows. However, what would be handy - and I'll look into this, is if I could somehow just scan to find the photos that were made on a camera and only edit those - because those are the only ones with any GPS location (and they are maybe 1/6th of all the photos). But I guess exiftool would do that anyway if you told it to remove GPS - it would only remove it from the ones that had it.

There are quite a lot of people saying exiftool doesn't seem to work on Windows 11 (so I could install Windows 10 on a spare laptop maybe). Or Linux - apparently exiftool can be installed as a package with linux .......... but running a code on the server would be a lot quicker!
 
Last edited:
Ok it's done :) Went back to the server bot. It did say yesterday that if .png wasn't included it might create errors. So asked for new code to include .png using GD libraries. Made a new file in public_html and ran that in the brower and it worked and said exif data removed. Then deleted the file (after downloading it and saving it). Wouldn't have trusted Chat GPT code but surely the server's own bot knows what's what?

Now I just need to check it's removed everything. I've saved the code and happy to share. But this was for Hostinger, which doesn't use cpanel, so whether it would differ with other servers I don't know but presumably public_html would be the same for all servers?

Actually it's something that needs doing regardless of Ofcom.

Not sure if it's a security risk to public_html to post the code on here, but happy to share it by message if anyone wants it.

Had a quick look through the site and photos all still seem fine. Downloaded the directories again to check the exif is all removed.
 
Last edited:
Seems to have worked after testing - no exif data and no GPS data. The ones taken on proper cameras just have minimal info like photo size.

Will probably install this addon now to remove GPS from any future uploaded photos - assuming it works in XF2.3. Is anyone using this? Or what do you do for exif removal?

wmtech

Thread '[WMTech] Exif Location Data Remover [Paid]'

wmtech submitted a new resource:

[WMTech] Exif Location Data Remover - Protect Your Users By Removing Hidden Location Content From Attachments

Description:
Exif Data Remover is an essential tool for professional XenForo boards to protect their users. Nowadays with GPS connected smartphones used to shoot photos, most pictures include hidden meta data (called "Exif" for "Exchangeable Image File Format") with information about the exact location where the photo was made (beside of other information). Many people do not...
Click to expand...
 
Last edited:
chillibear said:
Whilst large language AI models are impressive, ultimately they are just well adjusted word prediction - they don't actually "know", naive bayesian classifier if you like on steroids. I'm not sure I'd trust it to write code I then ran but didn't understand!

Assuming you are happy downloading and uploading files to your server via FTP (or similar) then you could get them (the attachments) all, process them locally on your desktop computer (if you can find a nice windows tool or get exiftool running locally okay) and then upload them again to replace those on the server. Remembering to take backups of course! That might be easier for you?
Click to expand...
Really appreciate all the help you've given on this - I didn't even know where to find the photos in the server until you posted about that.
 
This whole process is the antithesis of the hippy 70s isn't it? I have never liked a lot of heavy bureaucracy and this process has made me feel slightly inhuman. Which is why I didn't want to go through it in the first place and closed the site. But I want my forum back.

I am angry now and want to tell them to get xxxxed. It's authoritarian and making people read about things they shouldn't have to read about.

Anyway

I think I'm almost ready to go back online. Just waiting for an addon next week (an update to the AI Content moderator to include hyperlinks)

Am very grateful for all the tips and help on here.
 
Neal said:
Your contact link doesn't work, it points to /help/complaints-policy/%7BcontactUrl%7D
Click to expand...
You're right. The complaints link worked but the contact us here link didn't. @chillibear has kindly fixed that for me.

However it raises something else. It also doesn't work for unregistered members as I had "contact us" off for unregistered members. So presumably "complaints" needs to be available to all and not just registered members ..............

Which means I'd have to leave the "contact us" link showing for all as well and then it's likely to get spammed.

What do others do?
 
You must log in or register to reply here.
Back
Top Bottom