Avatar bug

McNutty · #1 6th June 2012, 09:52 AM

I've noticed that Chrome doesn't like this image, which is mothedrine's avatar. It claims there are multiple Content-Disposition headers being returned and refuses to display it for security reasons. I did a network trace on a fetch of this file and that error message isn't quite accurate: there is only one Content-Disposition header, but it's malformed due to having a space in an unquoted "filename" section (due to the fact that the uploaded file has a space in its name). Here's the header:

Code:

Content-disposition: inline; filename=blue moth, 100x80.jpg

It looks like vBulletin is supposed to be writing the header like this:

Code:

Content-disposition: inline; filename="blue moth, 100x80.jpg"

I wonder if vBulletin has a recommended fix for this problem. It could be a security issue if it means they're writing unsanitized filenames to HTTP response headers. I can think of a few ways to hand fix this instance if you wanted: 1) mothedrine could upload an av using a file without the spaces in the name, 2) image.php could be hacked to either not include the filename in the C-D header or to quote it properly, 3) the filename could have the spaces manually removed in the database.

mothedrine · #2 6th June 2012, 10:08 AM

OK - i'll try to find the original file, rename and upload again.

mothedrine · #3 6th June 2012, 10:13 AM

OK - try it now.

McNutty · #4 6th June 2012, 10:17 AM

Yup, looks better. Thanks!

Dragonlady · #5 6th June 2012, 01:19 PM

I thought he was doing it on purpose...

Annoying Retard Nonny · #6 6th June 2012, 01:32 PM

Quote:

Originally Posted by Dragonlady

I thought he was doing it on purpose...

Me too!

~Not Guin

mothedrine · #7 6th June 2012, 01:46 PM

I wish I'd known - I would have fixed it earlier.

But honestly - not being able to handle file names with embedded spaces? Yo VBulletin - the 70's called and said they want their file system back.