Images from FTP sites

[mrapples]

is there a reason why ftp is omitted as an accepted protocol for the img tag?

i have a user wanted to post images from his ftp, and i dont see any security rish there

thanks

[Dannii]

I don't think you can actually link to FTP images directly.. I've never seen it done.

[H]

I don't think you can actually link to FTP images directly.. I've never seen it done.

Indeed. http / ftp protocols really don't mix mainly because of the FTP authentication

If you own the server you could set up a low memory webserver such as lighttpd just to serve images from the ftp server

[mrapples]

well, its not an issue of it working or not, you can directly link to images using the protocol, and i have it working, i just wanted to know if there was a security reason or something similar that it caused it to be left out

[kegobeer]

I've never seen the FTP protocol used for serving images.  Can you post a link using the FTP protocol?

[mrapples]

certainly

hxxp:www.whatsinyourbox.org/index.php/topic,2017.0.html [nonactive]

[H]

wow. I thought all ftp links had to include the username and password (even for the anonymous user!)

Looks like I am wrong

[mrapples]

i believe in the server configuration you can specify if anonymous read transactions require a username and password, and i think write transactions always require authentication

[kegobeer]

Most people do not allow completely anonymous FTP access to a site, especially without any type of username/password.  This is the first time I've ever seen someone serving images using a file transfer protocol instead of a hypertext transfer protocol.  I would suggest that the developers never thought anyone would actually use said protocol to serve files, images, etc, so it was omitted from the bbcode function.

I would strongly advise against using FTP to serve images.  I was able to explore all of the files and directories hosted on the FTP account.  It's usually not a good idea to let total strangers have complete read access to all of your directories.  With HTTP, you have to guess at file names, and you can stop people from browsing the directory by uploading a blank index.html file.

[mrapples]

i am aware of this, and i believe the user is as well

[kegobeer]

You hacked the code to allow it, but I don't think it's something the developers will change in future releases.