Register Members List Search Today's Posts Mark Forums Read

Reply
 
Mod Options
Patched Flash Uploader to Fix Known Exploits Details »
Patched Flash Uploader to Fix Known Exploits
Mod Version: 2.00, by alexm (Coder) alexm is offline
Developer Last Online: Jun 2021 I like it Show Printable Version Email this Page

vB Version: 4.x.x Rating: (33 votes - 4.88 average) Installs: 204
Released: 14 Jan 2014 Last Update: Never Downloads: 845
Supported Code Changes Additional Files  

UPDATE Dec 2014: 4.2.2 PL2, 4.2.2 PL3 and 4.2.3 core download packages from vBulletin now include this patched version of uploader.swf as standard.

This is a patched version of YUI 2.9.0 uploader.swf as used by vBulletin 4.x for managing multiple file uploads.

An exploit was found in the flash uploader (uploader.swf) file supplied with vBulletin 4.x. This file is part of the Yahoo YUI 2 Library which is end of life and Yahoo have stated that they will not be fixing it. Yahoo recommends that the file is removed as the flash uploader has been deprecated.

vBulletin's recommended fix is to replace the file with an empty file of the same name. If you do this, however, and rely solely on the Ajax uploader you will not be able to select multiple files without further modifications.

This modification is a recompiled version of uploader.swf with the above exploit fixed. An additional potential exploit has also been fixed by disabling a parameter not used by vBulletin.

The YUI source used is provided freely by Yahoo to whom I give full credit.


1) Installation

a) Extract uploader.swf from the .zip file and replace your existing file here:

<forum_root>/clientscript/yui/uploader/assets/uploader.swf

b) Make sure the flash uploader is enabled in the Admin Control Panel

Options -> Message Attachment Options -> Asset Manager - Enable -> Select "Yes, Flash Upload by Default"

c) Make sure you are NOT using remote YUI

vBulletin Options -> Server Settings and Optimization Options

Use Remote YUI set to None

d) You may also need to clear your browser cache and/or vBulletin cache (Maintenance ->Clear system cache) if you have performed the above steps correctly but clicking the Upload button still does nothing.



2) Changes

11th January 2014

The parameter 'allowedDomain' has been sanitised with a REGEX to prevent malicious javascript being passed in a query string.


11th January 2014 v2

Many thanks to FranzBanz (http://www.vbulletin.com/forum/member/449383-franzbanz) for his suggestions
  • finding another exploit (using another parameter). Exploit fixed by setting the parameter (not used by vBulletin) to null.
  • '-' Character added to allowed characters in allowedDomain


Non-Flash Alternative
Please note that if you would rather avoid using flash altogether an alternative Mod has been released by BirdOPrey5, although there are some compromises/limitations with IE10+.

Asset Manager / Image Upload Fix to upload multiple files like the Flash uploader


DISCLAIMER
I am not a flash developer, I am just another vBulletin customer trying to keep his members happy!
This file is provided free of charge for the benefit of the vBulletin community. You use it at your own risk!


Copyright Đ 2013 Yahoo! Inc. All rights reserved.
Redistribution and use of this software in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

Neither the name of Yahoo! Inc. nor the names of YUI's contributors may be used to endorse or promote products derived from this software without specific prior written permission of Yahoo! Inc.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Download Now

Only licensed members can download files, Click Here for more information.

Show Your Support

  • To receive notifications regarding updates -> Click to Mark as Installed.
  • This modification may not be copied, reproduced or published elsewhere without author's permission.
  #91  
Old 01 Jun 2014, 19:58
sstiller sstiller is offline
 
Join Date: Dec 2012
Many thanks! It works
Reply With Quote
  #92  
Old 06 Jun 2014, 11:47
alexm's Avatar
alexm alexm is offline
 
Join Date: Apr 2005
Originally Posted by rharbison View Post
Update - The problem seems to be in VB 4.2.2 itself, even when using the 0 byte version of Uploader.swf, the problem still exists.

VB 4.2 PL 1 seems to have broken this. With the modified version of uploader.swf, the images SEEM to work. While editing your message they show up in the post just fine. However... When you save the message, you only get a link to the attachment, not the image.

Anyone else seeing this? Anyone got a solution?
I just spotted this reply to your thread on vb.com

http://www.vbulletin.com/forum/forum...39#post4047539

For anyone else experiencing this issue:
I figured out my issue. Under General Settings>Disable AJAX Features, I had "Disable problematic AJAX features" selected. When I went back and selected "Enable all AJAX features", the quick reply started working properly again.
Reply With Quote
  #93  
Old 26 Aug 2014, 04:03
webducknj webducknj is offline
 
Join Date: Dec 2010
does this patch allow you to upload more than 10 files at a time as attachments?

thanks,
bart
Reply With Quote
  #94  
Old 26 Aug 2014, 05:34
Zachery's Avatar
Zachery Zachery is offline
 
Join Date: Jul 2002
Real name: Zachery Woods
The number of files allowed to be uploaded at once (outside of having flash) is limited by a lot of factors.
__________________
Looking for ImpEx?
Reply With Quote
  #95  
Old 26 Aug 2014, 12:19
webducknj webducknj is offline
 
Join Date: Dec 2010
i've seen vb sites where uploads of 100 or more files is possible. so it's just a matter of finding the right developer to fix it?

suggestions/referrals appreciated.

and thanks for the reply.
Reply With Quote
  #96  
Old 26 Aug 2014, 15:49
Zachery's Avatar
Zachery Zachery is offline
 
Join Date: Jul 2002
Real name: Zachery Woods
There are a lot of things that come into play with uploading lots of files. More than just the flash uploader.
__________________
Looking for ImpEx?
Reply With Quote
  #97  
Old 07 Oct 2014, 18:00
Jennifer2010 Jennifer2010 is offline
 
Join Date: Mar 2011
New error: Latest version of FireFox appears to create the file selection dialogue behind all other windows after clicking the "Select Files" button. I've verified this on my end and all of my forum's members seem to experience this. Can anyone else verify and possibly provide a solution?
Reply With Quote
  #98  
Old 08 Oct 2014, 08:38
Mark.B Mark.B is offline
 
Join Date: Feb 2004
I'm on the latest Firefox and that isn't happening.

Try it with a default style.
__________________
MARK.B (Member of the vB Support Team)
Reply With Quote
  #99  
Old 08 Oct 2014, 12:34
alexm's Avatar
alexm alexm is offline
 
Join Date: Apr 2005
Originally Posted by Mark.B View Post
I'm on the latest Firefox and that isn't happening.

Try it with a default style.
+1

I've just recommended the same thing in the OP's thread on vb.com
Reply With Quote
  #100  
Old 08 Oct 2014, 12:39
alexm's Avatar
alexm alexm is offline
 
Join Date: Apr 2005
Actually, didn't you have a problem before relating to a custom style/button?

Bet your problem is there!

Originally Posted by Jennifer2010 View Post
Problem resolved:
We have a custom "Upload Images" button that calls the same function as the insert image button does on the post editor. However, after we upgraded to 4.2.2 it must not be compatible. Thus, all we have to do now is find the new code and it should work (default vb style works perfect)

I can't remember where I found the old code:
<span class="cke_button">
<input type="button" style="height: 30px; width: 100px; font-size: 14px; margin-top: 15px;" a id="cke_38" class="cke_off cke_button_vbimage" onclick="CKEDITOR.tools.callFunction(77, this); return false;" onfocus="return CKEDITOR.tools.callFunction(76, event);" onkeydown="return CKEDITOR.tools.callFunction(75, event);" onblur="this.style.cssText = this.style.cssText;" aria-labelledby="cke_38_label" hidefocus="true" tabindex="-1" value="Upload Images">
</a>
</span>

Anyway it's not a server issue anymore, lol.
Reply With Quote
  #101  
Old 10 Oct 2014, 09:12
z3r0's Avatar
z3r0 z3r0 is offline
 
Join Date: Apr 2005
Location: Lancashire, UK
Originally Posted by Jennifer2010 View Post
New error: Latest version of FireFox appears to create the file selection dialogue behind all other windows after clicking the "Select Files" button. I've verified this on my end and all of my forum's members seem to experience this. Can anyone else verify and possibly provide a solution?
Yep, I've just noticed this myself.

Edit - It seems to be a bug in Firefox, a quick google turns up the XF guys working out a fix for their software here - https://xenforo.com/community/thread...-3#post-832948

Last edited by z3r0; 10 Oct 2014 at 09:41.
Reply With Quote
  #102  
Old 10 Oct 2014, 20:19
tbworld tbworld is offline
 
Join Date: Oct 2008
Thanks for sharing some clarity on the subject.
Reply With Quote
  #103  
Old 15 Nov 2014, 12:56
MrD's Avatar
MrD MrD is offline
 
Join Date: Aug 2003
Real name: Marcus
Hi,
the Uploader are not Working about 5 days?
The other Time, itīs worked perfect.

vb 4.2.2 pl2
__________________
Greetz from Dortmund/Germany
Marcus
Reply With Quote
  #104  
Old 15 Nov 2014, 20:16
alexm's Avatar
alexm alexm is offline
 
Join Date: Apr 2005
What's actually happening? If you just upgraded to PL2 did you remember to re-upload uploader.swf?
Reply With Quote
  #105  
Old 16 Nov 2014, 10:58
MrD's Avatar
MrD MrD is offline
 
Join Date: Aug 2003
Real name: Marcus
Hi,
the Window with the Files are not open. only the overlay window.
yes i upgrade to 4.2.2 and i re-upload the swf.

But now it works, after i clear my cache.
Itīs Amazing
__________________
Greetz from Dortmund/Germany
Marcus
Reply With Quote
Reply


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Mod Options

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


New To Site? Need Help?

All times are GMT. The time now is 04:47.

Layout Options | Width: Wide Color: