Uploading avatar issue

[Yojin_Spajin]

Hi,

We recently our forum update from SMF 1.1.4 to 1.1.20. All seems to be OK, except one thing :

The avatar upload function is out of service. When we try to upload an avatar, the following message appears :

Your attachment couldn't be saved. This might happen because it took too long to upload or the file is bigger than the server will allow.

Please consult your server administrator for more information.

On the other hand uploading avatars with a link works normally.

We are using no mods (except some light BBcode add) and the configuration of our server has not changed (and it was working before the update). Our attachment directory is set in chmod 777.

Have you an idea of the problem and its fix ? Thank !

[Ninja ZX-10RR]

Does this happen to all users or just for one? (ex: slow connection, broke server upload time limit)
Did you run out of space on your server?
How big is that avatar? What happens if you upload it here? Format? Does this happen with ALL avatars or just one/a few?

[Yojin_Spajin]

Hi !

It happens to all users. It does not depend of the size of the avatar or its format, and we are not out of space at all. Limitations on avatars have not changed in the config, as the server config.

Thank you for your attention.

[kat]

First-off, is there anything in the error log, pertaining to this?

The...

This might happen because it took too long to upload or the file is bigger than the server will allow.

...part makes me think that...

Please consult your server administrator for more information.

... is a good plan. If they upgraded their server, those setting just might've changed.

[Yojin_Spajin]

We have our own server, and I can say nothing has changed concerning it configuration. This bug appeared just accordingly to the patching.

Thank.

[kat]

Can you edit php.ini, to increase the timeout setting?

[Yojin_Spajin]

Hi : php.ini can't be guilty, it has not been modified.

I've fix the problem editing Sources/Profil.php :

I've mainly disable the "paranoïd check" :

Code Select Expand

// Paranoid check. Some like it that way.
if (preg_match('~(iframe|\\<\\?|\\<%|html|eval|body|script\W|[CF]WS[\x01-\x0C])~i', $prev_chunk . $cur_chunk) === 1)
{

fclose($fp);
if (file_exists($uploadDir . '/avatar_tmp_' . $memID)) {
@unlink($uploadDir . '/avatar_tmp_' . $memID);
echo $uploadDir . '/avatar_tmp_' . $memID;
fatal_lang_error('smf124');
}
}

As I've no idea about what it is supposed to check... but now it works again.

Thank you all !

[Biology Forums]

But now a pesky user can introduce MySQL injections... Potentially.

[Arantor]

Not so much SQL injections, more things that can just take over your server account, which is marginally more dangerous than SQL injections.

[Biology Forums]

That said, make sure you make daily backups.

[Arantor]

Yes, because backing up dangerous files is a good plan