Image Security

[Todge]

I have now disabled the Quote button on posts containing images.

You can download the finished plugin here.

[Former Member]

Ah... so all posts containing images can't be quoted. Is that the price that has to be paid?

[Todge]

Mar 9, 2016 0:53:11 GMT -8 @ritab said:

Ah... so all posts containing images can't be quoted. Is that the price that has to be paid?

I'm afraid so.

The reason the plugin failed to find some images previously was because it had to wait for the images to load fully to get their dimensions, so each time you changed pages, the code would have to look for images again, then wait for them to load before it could secure them. Because this new version acts on the images before the dimensions are known, it will see ALL posted images and take initial actions there and then.. The main one being disabling the Quote button.

I do have a different idea that would get ove this, but that would be a totally different technique, and while it should in theory be more secure, it would not be compatible with already posted images, which would then become insecure.

[P̌̓aͧś̀t̀u͒le͆o͂2̀3̃̓]

Mar 10, 2016 14:11:28 GMT -8 Todge said:

Mar 9, 2016 0:53:11 GMT -8 @ritab said:

Ah... so all posts containing images can't be quoted. Is that the price that has to be paid?

I'm afraid so.

The reason the plugin failed to find some images previously was because it had to wait for the images to load fully to get their dimensions, so each time you changed pages, the code would have to look for images again, then wait for them to load before it could secure them. Because this new version acts on the images before the dimensions are known, it will see ALL posted images and take initial actions there and then.. The main one being disabling the Quote button.

I do have a different idea that would get ove this, but that would be a totally different technique, and while it should in theory be more secure, it would not be compatible with already posted images, which would then become insecure.

Couldnt you just get the wysiwig and strip out image tags?
That being instead of removing the quote button

[Todge]

Mar 10, 2016 14:33:56 GMT -8 P̌̓aͧś̀t̀u͒le͆o͂2̀3̃̓ said:

Mar 10, 2016 14:11:28 GMT -8 Todge said:

I'm afraid so.

The reason the plugin failed to find some images previously was because it had to wait for the images to load fully to get their dimensions, so each time you changed pages, the code would have to look for images again, then wait for them to load before it could secure them. Because this new version acts on the images before the dimensions are known, it will see ALL posted images and take initial actions there and then.. The main one being disabling the Quote button.

I do have a different idea that would get ove this, but that would be a totally different technique, and while it should in theory be more secure, it would not be compatible with already posted images, which would then become insecure.

Couldnt you just get the wysiwig and strip out image tags?
That being instead of removing the quote button

I could, and did originally, but with what seemed like an endless variation on how the images were being displayed in the wysiwyg editor I gave up, and went for the easier option of removing the quote ability instead.

I had to do something similar with the smiley plugin, which was bad enough, and that only had to deal with the BBCode side of things, but in theory at least, that would be the harder side to manage...

Maybe I should look into it some more

[P̌̓aͧś̀t̀u͒le͆o͂2̀3̃̓]

Mar 10, 2016 14:42:41 GMT -8 Todge said:

Mar 10, 2016 14:33:56 GMT -8 P̌̓aͧś̀t̀u͒le͆o͂2̀3̃̓ said:

Couldnt you just get the wysiwig and strip out image tags?
That being instead of removing the quote button

I could, and did originally, but with what seemed like an endless variation on how the images were being displayed in the wysiwyg editor I gave up, and went for the easier option of removing the quote ability instead.

I had to do something similar with the smiley plugin, which was bad enough, and that only had to deal with the BBCode side of things, but in theory at least, that would be the harder side to manage...

Maybe I should look into it some more

U just need chris to give you a regex  Chris would have the best idea.

[Todge]

Poor Chris, the things he has to put up with for being the best coder here.

[Former Member]

Mar 10, 2016 14:11:28 GMT -8 Todge said:

Mar 9, 2016 0:53:11 GMT -8 @ritab said:

Ah... so all posts containing images can't be quoted. Is that the price that has to be paid?

I'm afraid so.

The reason the plugin failed to find some images previously was because it had to wait for the images to load fully to get their dimensions, so each time you changed pages, the code would have to look for images again, then wait for them to load before it could secure them. Because this new version acts on the images before the dimensions are known, it will see ALL posted images and take initial actions there and then.. The main one being disabling the Quote button.

I do have a different idea that would get ove this, but that would be a totally different technique, and while it should in theory be more secure, it would not be compatible with already posted images, which would then become insecure.

Shucks. Blimey being a coder sure is hard work. Thanks for all your efforts trying to resolve this issue, but I won't run the latest version, instead I'll wait for your totally different technique.