Register Members List Search Today's Posts Mark Forums Read

Reply
 
Mod Options
Patched Flash Uploader to Fix Known Exploits Details »
Patched Flash Uploader to Fix Known Exploits
Mod Version: 2.00, by alexm (Coder) alexm is offline
Developer Last Online: Jun 2021 I like it Show Printable Version Email this Page

vB Version: 4.x.x Rating: (33 votes - 4.88 average) Installs: 204
Released: 14 Jan 2014 Last Update: Never Downloads: 845
Supported Code Changes Additional Files  

UPDATE Dec 2014: 4.2.2 PL2, 4.2.2 PL3 and 4.2.3 core download packages from vBulletin now include this patched version of uploader.swf as standard.

This is a patched version of YUI 2.9.0 uploader.swf as used by vBulletin 4.x for managing multiple file uploads.

An exploit was found in the flash uploader (uploader.swf) file supplied with vBulletin 4.x. This file is part of the Yahoo YUI 2 Library which is end of life and Yahoo have stated that they will not be fixing it. Yahoo recommends that the file is removed as the flash uploader has been deprecated.

vBulletin's recommended fix is to replace the file with an empty file of the same name. If you do this, however, and rely solely on the Ajax uploader you will not be able to select multiple files without further modifications.

This modification is a recompiled version of uploader.swf with the above exploit fixed. An additional potential exploit has also been fixed by disabling a parameter not used by vBulletin.

The YUI source used is provided freely by Yahoo to whom I give full credit.


1) Installation

a) Extract uploader.swf from the .zip file and replace your existing file here:

<forum_root>/clientscript/yui/uploader/assets/uploader.swf

b) Make sure the flash uploader is enabled in the Admin Control Panel

Options -> Message Attachment Options -> Asset Manager - Enable -> Select "Yes, Flash Upload by Default"

c) Make sure you are NOT using remote YUI

vBulletin Options -> Server Settings and Optimization Options

Use Remote YUI set to None

d) You may also need to clear your browser cache and/or vBulletin cache (Maintenance ->Clear system cache) if you have performed the above steps correctly but clicking the Upload button still does nothing.



2) Changes

11th January 2014

The parameter 'allowedDomain' has been sanitised with a REGEX to prevent malicious javascript being passed in a query string.


11th January 2014 v2

Many thanks to FranzBanz (http://www.vbulletin.com/forum/member/449383-franzbanz) for his suggestions
  • finding another exploit (using another parameter). Exploit fixed by setting the parameter (not used by vBulletin) to null.
  • '-' Character added to allowed characters in allowedDomain


Non-Flash Alternative
Please note that if you would rather avoid using flash altogether an alternative Mod has been released by BirdOPrey5, although there are some compromises/limitations with IE10+.

Asset Manager / Image Upload Fix to upload multiple files like the Flash uploader


DISCLAIMER
I am not a flash developer, I am just another vBulletin customer trying to keep his members happy!
This file is provided free of charge for the benefit of the vBulletin community. You use it at your own risk!


Copyright 2013 Yahoo! Inc. All rights reserved.
Redistribution and use of this software in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

Neither the name of Yahoo! Inc. nor the names of YUI's contributors may be used to endorse or promote products derived from this software without specific prior written permission of Yahoo! Inc.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Download Now

Only licensed members can download files, Click Here for more information.

Show Your Support

  • To receive notifications regarding updates -> Click to Mark as Installed.
  • This modification may not be copied, reproduced or published elsewhere without author's permission.
  #76  
Old 18 Apr 2014, 10:27
Toorak Times's Avatar
Toorak Times Toorak Times is offline
 
Join Date: Jan 2011
Google Chrome?

For some reason a lot of my plugins will not even appear in Google Chrome but appear in Firefox and Safari no probs
Reply With Quote
  #77  
Old 19 Apr 2014, 19:45
rharbison rharbison is offline
 
Join Date: Apr 2002
Update - The problem seems to be in VB 4.2.2 itself, even when using the 0 byte version of Uploader.swf, the problem still exists.

VB 4.2 PL 1 seems to have broken this. With the modified version of uploader.swf, the images SEEM to work. While editing your message they show up in the post just fine. However... When you save the message, you only get a link to the attachment, not the image.

Anyone else seeing this? Anyone got a solution?

Last edited by rharbison; 19 Apr 2014 at 20:08.
Reply With Quote
  #78  
Old 25 Apr 2014, 14:47
alexm's Avatar
alexm alexm is offline
 
Join Date: Apr 2005
Originally Posted by K!nG View Post
Since u asked for browser , I just checked it in IE and it's working fine. I only use chrome and it was working fine, but all of sudden it's not.

a) Upload the modified SWF file and make sure the flash uploader is enabled in the Admin Control Panel

Options -> Message Attachment Options -> Asset Manager - Enable -> Select "Yes, Flash Upload by Default"

b) vBulletin Options -> Server Settings and Optimization Options

Use Remote YUI set to None

c) Close your forum page and clear your browser cache - a lot of the issues where clicking the upload button does nothing is due to browser caching issues

Hopefully this helps!

Last edited by alexm; 25 Apr 2014 at 15:06.
Reply With Quote
  #79  
Old 25 Apr 2014, 14:56
alexm's Avatar
alexm alexm is offline
 
Join Date: Apr 2005
Originally Posted by rharbison View Post
Update - The problem seems to be in VB 4.2.2 itself, even when using the 0 byte version of Uploader.swf, the problem still exists.

VB 4.2 PL 1 seems to have broken this. With the modified version of uploader.swf, the images SEEM to work. While editing your message they show up in the post just fine. However... When you save the message, you only get a link to the attachment, not the image.

Anyone else seeing this? Anyone got a solution?
I can't replicate this I'm afraid. I'm using 4.2.2 PL1 too and everything seems to work just fine. I'm using the standard, unmodified editor with asset manager and attachments work both via asset manager and in quick reply.
Reply With Quote
  #80  
Old 26 Apr 2014, 02:17
rharbison rharbison is offline
 
Join Date: Apr 2002
OK, so here's the odd thing. I run about 6 forums (yes, all licensed). All are, as far as I know, the same. All are running V 4.2.2 PL1. One of the forums is having a problem with the attachments not showing up inline. It's reproducible, but also somewhat random.
Reply With Quote
  #81  
Old 26 Apr 2014, 02:30
alexm's Avatar
alexm alexm is offline
 
Join Date: Apr 2005
Not sure what to suggest... presume you've tried re-uploading all the vBulletin files in case something got corrupted during transfer? (remember to replace uploader.swf again afterwards!)

If that doesn't do it then maybe try reverting any relevant templates?
Reply With Quote
  #82  
Old 26 Apr 2014, 04:15
rharbison rharbison is offline
 
Join Date: Apr 2002
Alex, yep, tried re-uploading.

My templates are all stock, I've run VB for many years ago, and long ago tired of customizing everything like a kid putting rims and spoilers on his new ride, only to have a new release require them to all be done over. I now run my forums as stock as I can possibly get and try to do any customizing, like ads, from within the framework.

What's really strange is why a couple forums on the same server would have one not work and another one work. But in any case, I decided I'd had enough hassles to trying to make it work and decided that was going to be my XF testbed.
Reply With Quote
  #83  
Old 27 Apr 2014, 12:23
weave weave is offline
 
Join Date: Jun 2011
This is no longer working for me on 4.2.2 PL1 either. Clicking the button does nothing at all.

I have made sure I have the right file and settings no less than 3 times.

I have run the maintenance test, no issues found.

I have tried with.

APPLE:
Safari
Chrome
Firefox

Windows7:
IE 11
Firefox

Windows8:
IE11

The ONLY time I got it to work was on Windows with IE and all plugins/hooks disabled. It still was not working on the others.

Any ideas?

Thanks

Last edited by weave; 28 Apr 2014 at 15:55. Reason: Added comment as to WHAT the issue is
Reply With Quote
  #84  
Old 28 Apr 2014, 09:55
alexm's Avatar
alexm alexm is offline
 
Join Date: Apr 2005
Originally Posted by weave View Post
This is no longer working for me on 4.2.2 PL1 either.

I have made sure I have the right file and settings no less than 3 times.

I have run the maintenance test, no issues found.

I have tried with.

APPLE:
Safari
Chrome
Firefox

Windows7:
IE 11
Firefox

Windows8:
IE11

The ONLY time I got it to work was on Windows with IE and all plugins/hooks disabled. It still was not working on the others.

Any ideas?

Thanks
Need more info. What is actually happening?
Reply With Quote
  #85  
Old 28 Apr 2014, 15:55
weave weave is offline
 
Join Date: Jun 2011
Originally Posted by alexm View Post
Need more info. What is actually happening?
Nothing. The button is there but clicking it does nothing at all.
Reply With Quote
  #86  
Old 28 Apr 2014, 19:09
alexm's Avatar
alexm alexm is offline
 
Join Date: Apr 2005
Have you tried all the following?...

1) Make sure the flash uploader is enabled in the Admin Control Panel

Options -> Message Attachment Options -> Asset Manager - Enable -> Select "Yes, Flash Upload by Default"

2) Make sure you are NOT using remote YUI

vBulletin Options -> Server Settings and Optimization Options

Use Remote YUI set to None

3) Clear your browser cache

4) Clear VB cache

Maintenance ->Clear system cache


Can you PM me a link to your forum and a test account with upload permission and I'll try to take a look?
Reply With Quote
  #87  
Old 01 May 2014, 16:16
weave weave is offline
 
Join Date: Jun 2011
Originally Posted by alexm View Post
Have you tried all the following?...

1) Make sure the flash uploader is enabled in the Admin Control Panel

Options -> Message Attachment Options -> Asset Manager - Enable -> Select "Yes, Flash Upload by Default"

2) Make sure you are NOT using remote YUI

vBulletin Options -> Server Settings and Optimization Options

Use Remote YUI set to None

3) Clear your browser cache

4) Clear VB cache

Maintenance ->Clear system cache


Can you PM me a link to your forum and a test account with upload permission and I'll try to take a look?
Let me add the SWF back and will send you the PM with the logon info.

Thanks.
Reply With Quote
  #88  
Old 01 May 2014, 18:22
weave weave is offline
 
Join Date: Jun 2011
Originally Posted by weave View Post
Let me add the SWF back and will send you the PM with the logon info.

Thanks.
So now, for whatever reason, this is ALL working on my MAC.

I tested with:
Safari
Chrome
Firefox

And it all working.....but I did not do anything any different than before.
Reply With Quote
  #89  
Old 03 May 2014, 18:02
Mickie D Mickie D is offline
 
Join Date: Jun 2002
great work thank you!
__________________
Digitalworldz Satellite Cable TV Forums
Cable, Satellite, Consoles, Mobile Phones, Audio Visual, and general chat
Reply With Quote
  #90  
Old 15 May 2014, 19:45
cloudfarmer cloudfarmer is offline
 
Join Date: Apr 2014
woo hoo!! thankyou so much. To anyone else that is completely new at this sort of thing, you must delete your browser cache if using Chrome. I kept missing this step and it would not work.

using 4.2.2
Reply With Quote
Reply


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Mod Options

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


New To Site? Need Help?

All times are GMT. The time now is 16:57.

Layout Options | Width: Wide Color: