Simple Machines Community Forum

SMF Support => SMF 2.0.x Support => Topic started by: WimB on October 27, 2013, 03:25:04 PM

Title: Problem with avatars and attachments in IE after installing 2.0.6
Post by: WimB on October 27, 2013, 03:25:04 PM
This morning we installed patch 2.0.6 to our forum (update from 2.0.5). Our members which are using IE can no longer see some of the avatars and attachments. They work perfectly in Firefox, Safari,....

Anyone any idea what the cause might be? (something with the programming which IE doesn't digest very well it would seem ;))
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: Arantor on October 27, 2013, 03:38:12 PM
Well... the 2.0.6 patch did not change how avatars and attachments are served. It *did* change how avatars get *saved* but that only kicks in when someone actually updates their avatar.

What else changed for your users?
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: WimB on October 27, 2013, 03:43:24 PM
The only thing we changed was update the patch and change the time from summertime to wintertime.

For the rest no changes were made and I've heard no other complaints, when the IE users renew their avatar, it is visible again in IE, but that's not possible for the attachments.
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: Arantor on October 27, 2013, 03:50:57 PM
I don't know what to tell you.

Here's what I know, for certain (mostly because I'm the one who wrote the patch)...

1) The patch did not touch Display.php, which is where action=dlattach is located (and action=dlattach is what serves avatars and attachments)

2) The only change that does come up in index.php?action=dlattach is the change to index.php where extra headers were added. If the headers were damaging the process, it would break new uploads too.

As a test, though, you could try commenting out this line from index.php:
header('X-Content-Type-Options: nosniff');

But as I understand it, both Facebook and Twitter use this and they haven't had any problems.

Is it all IE users on your site? Is it all files or just some of them?
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: WimB on October 27, 2013, 03:54:28 PM
Quote from: Arantor on October 27, 2013, 03:50:57 PM
I don't know what to tell you.

Here's what I know, for certain (mostly because I'm the one who wrote the patch)...

1) The patch did not touch Display.php, which is where action=dlattach is located (and action=dlattach is what serves avatars and attachments)

2) The only change that does come up in index.php?action=dlattach is the change to index.php where extra headers were added. If the headers were damaging the process, it would break new uploads too.

As a test, though, you could try commenting out this line from index.php:
header('X-Content-Type-Options: nosniff');

But as I understand it, both Facebook and Twitter use this and they haven't had any problems.

Is it all IE users on your site? Is it all files or just some of them?

Thanks Arantor, will try the commenting out.

All IE users have the problem (all versions of IE) and it's just some of the files, but it's not related to the format, they are all jpg but the pics that are still visible are jpg too.
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: WimB on October 27, 2013, 04:04:34 PM
commenting that out didn't change anything either....Thank you very much for helping Arantor!
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: Arantor on October 27, 2013, 04:05:24 PM
Is there anything the files have in common?

Do they have funny characters in the names (when they don't work properly)?
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: WimB on October 27, 2013, 04:13:48 PM
Quote from: Arantor on October 27, 2013, 04:05:24 PM
Is there anything the files have in common?

Do they have funny characters in the names (when they don't work properly)?

Nothing in common....no funny characters in the names.
Just noticed that when I rightclick on the black x where the attachment should be and select "open link in a new tab", it shows the attachment correctly.
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: Arantor on October 27, 2013, 04:20:20 PM
Ah, so thumbnail generation failed. But my changes didn't touch Subs-Graphics where that occurs.
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: WimB on October 27, 2013, 04:23:17 PM
So, something we changed must have affected Subs-Graphics in a way that only IE responds badly to it.....
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: Arantor on October 27, 2013, 04:24:23 PM
Well, it wasn't 2.0.6...
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: WimB on October 27, 2013, 04:26:57 PM
Quote from: Arantor on October 27, 2013, 04:24:23 PM
Well, it wasn't 2.0.6...

Nope, thanks for the help...will have a look at that.
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: mashby on October 27, 2013, 04:28:08 PM
Some avatars and attachments? Mind providing a link to where an avatar isn't displaying properly in IE? And one with attachments, too?
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: WimB on October 27, 2013, 04:31:06 PM
Quote from: monster mashby on October 27, 2013, 04:28:08 PM
Some avatars and attachments? Mind providing a link to where an avatar isn't displaying properly in IE? And one with attachments, too?

Here you go monster M: http : //www.vrvforum.be/forum/index.php?topic=1209.0
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: lurkalot on October 27, 2013, 05:50:53 PM
Quote from: Arantor on October 27, 2013, 04:24:23 PM
Well, it wasn't 2.0.6...

Arantor.  Well I'm glad I read this thread.  As you know I uploaded a fresh set of files to my site and now I'm missing some of my users avatars too. they also show in Firefox and Chrome, but not in IE10 as they did before the upgrade.  ???
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: Arantor on October 27, 2013, 06:00:26 PM
OK, so let's try something really crazy.

Comment out this line from index.php.
header('X-XSS-Protection: 1; mode=block');
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: lurkalot on October 27, 2013, 06:36:16 PM
Quote from: Arantor on October 27, 2013, 06:00:26 PM
OK, so let's try something really crazy.

Comment out this line from index.php.
header('X-XSS-Protection: 1; mode=block');

Tried it, but unfortunately it made no difference.  :(
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: Arantor on October 27, 2013, 06:41:08 PM
I didn't really expect it to, but it was one option that might have done; IE is a bit crazy when it comes to those headers (even though it was IE that introduced them originally!)
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: lurkalot on October 27, 2013, 07:20:28 PM
Strange how its just blocking some and not all off the uploaded avatars.  If I go to Admin > Forum > Attachments and avatars > Browse files > Avatars, the missing ones are there, and I can view them.

Some Of my members have since uploaded them again (including me).
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: WimB on October 28, 2013, 05:31:13 AM
Really strange.... nothing seems to have changed in Subs-Graphics either  :o
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: Arantor on October 28, 2013, 06:32:32 AM
I know that... I'm the one who *made* the 2.0.6 patch...
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: watchhorse on October 28, 2013, 10:32:25 AM
I have the same problem. ???
Also after update.
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: Arantor on October 28, 2013, 10:34:53 AM
And yet as shown the patch doesn't TOUCH the avatars or attachments code...

You could try commenting out the three headers in index.php that were added but they didn't break it for me when I tested it...
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: lurkalot on October 28, 2013, 11:17:42 AM
Quote from: Arantor on October 28, 2013, 10:34:53 AM
And yet as shown the patch doesn't TOUCH the avatars or attachments code...

You could try commenting out the three headers in index.php that were added but they didn't break it for me when I tested it...

Arantor, did just that and I can now confirm the Avatars are working again. ;)
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: Arantor on October 28, 2013, 11:28:50 AM
And commenting out the last two didn't fix it before?

The Frame-Options header should NOT be doing that. Proof, if any were needed, that IE still lags behind in supporting something that's been around for years.


Still, if you'd rather have less security, that's entirely up to you.
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: lurkalot on October 28, 2013, 11:40:33 AM
Quote from: Arantor on October 28, 2013, 11:28:50 AM

And commenting out the last two didn't fix it before?


I didn't try the last two before, just this line that you told us to try header('X-XSS-Protection: 1; mode=block');

Which didn't make any difference for me.  Then I tried all three headers as you just suggested and the avatars work again.


header('X-Frame-Options: SAMEORIGIN');
header('X-XSS-Protection: 1; mode=block');
header('X-Content-Type-Options: nosniff');
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: Arantor on October 28, 2013, 11:43:54 AM
Um, if you read the thread, I suggested removing the last two at separate points in the thread.

So it's down to the Frame-Options header, which is fantastic because that's the most useful of the headers to add. Interestingly, Facebook and Twitter use the same header - so it's down to IE as to why it doesn't work.
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: lurkalot on October 28, 2013, 12:04:33 PM
Quote from: Arantor on October 28, 2013, 11:43:54 AM
Um, if you read the thread, I suggested removing the last two at separate points in the thread.

So it's down to the Frame-Options header, which is fantastic because that's the most useful of the headers to add. Interestingly, Facebook and Twitter use the same header - so it's down to IE as to why it doesn't work.

Sorry, I should have read back the whole thread.  :-[

But after a bit of testing, it's actually this line alone that's stopping the avatars showing header('X-Content-Type-Options: nosniff');  Not the Frame options one.
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: Arantor on October 28, 2013, 12:26:40 PM
That's even more hilarious... that's a feature IE themselves invented first!

Makes me wonder why it's broken anything else.
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: mashby on October 28, 2013, 12:42:16 PM
Hmm...looking at the differences between here and the OP's site.
OP's avatar:
http://www.vrvforum.be/forum/index.php?action=dlattach;attach=27229;type=avatar
in IMG tag:
(http://www.vrvforum.be/forum/index.php?action=dlattach;attach=27229;type=avatar)
Arantor's avatar:
http://avatars.simplemachinesweb.com/smf/avatar_318771_1380747238.jpg
in IMG tag:
(http://avatars.simplemachinesweb.com/smf/avatar_318771_1380747238.jpg)

I'm guessing here is different in terms of avatar paths. Here looks more "normal" in terms of an img src, but the other way seems to work OK too, just not always in IE.

In IE10, the img referenced from the IMG tag indeed doesn't show up. :)
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: Arantor on October 28, 2013, 12:43:32 PM
That's because here has avatars set to an avatar directory because it makes things *crazy* faster. That wouldn't fix attachments though.
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: margarett on October 28, 2013, 12:59:05 PM
Quote from: monster mashby on October 28, 2013, 12:42:16 PM
In IE10, the img referenced from the IMG tag indeed doesn't show up. :)
In IE8 also doesn't show up. IE8 is damn old, but it's strange the the issue crosses so different versions...
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: Arantor on October 28, 2013, 01:03:11 PM
Especially for a header introduced in IE8 for 'better security'.

Though I get the feeling it should really be issuing proper MIME type headers and nosniff confuses it.
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: WimB on October 28, 2013, 01:44:43 PM
Thanks to all (and especially to Arantor)  :)

it works again, after commenting out all three, only commenting out header('X-Content-Type-Options: nosniff'); didn't work over here. Will have to do with less security, I guess....IE (sigh)  >:(
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: margarett on October 28, 2013, 01:49:06 PM
Well, I guess you can minimize the damage by putting out that lines only if browser is IE by looking at _SERVER['HTTP_USER_AGENT']
?

Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: GrogHead on October 28, 2013, 07:32:01 PM
Quote from: Arantor on October 28, 2013, 12:26:40 PM
That's even more hilarious... that's a feature IE themselves invented first!

Makes me wonder why it's broken anything else.

This may need to go in a new thread, but it looks like you may be asking if IE broke anything else.

We just upgraded to 2.0.6 today. This morning I had a user access our forum with no problem using IE 10. This afternoon (after upgrading to 2.0.6) he tells me he cannot access our forums. He installed Chrome and has no problems.

He tried to access on two different machines, both running IE. He has tried deleting cookies and internet files then rebooting with no change. He gets the following error when he tries to hit us:

QuoteAn Error Has Occurred!


Session verification failed. Please try logging out and back in again, and then try again.

Any suggestions would be appreciated.
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: Arantor on October 28, 2013, 07:36:47 PM
Well, I'm not so much asking whether it did, all evidence is that it did. I'm asking *why*, because the changes that were made were made to Microsoft's *own* specification; Microsoft added that header in IE and adoption is growing.

But yours is the first example of it actually failing something else. You can try commenting out the headers as suggested and see if that makes a difference.
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: GrogHead on October 28, 2013, 08:33:23 PM
Quote from: Arantor on October 28, 2013, 07:36:47 PM
Well, I'm not so much asking whether it did, all evidence is that it did. I'm asking *why*, because the changes that were made were made to Microsoft's *own* specification; Microsoft added that header in IE and adoption is growing.

But yours is the first example of it actually failing something else. You can try commenting out the headers as suggested and see if that makes a difference.

Thanks. I think we're just going to encourage folks to use a different browser.

In any case, if you need anything from me were you to decide to try and debug MS's problem, feel free to contact me  8)
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: lurkalot on October 30, 2013, 01:36:41 PM
@ Arantor.  Just curious, if these headers are causing certain Avatars not to display, then why do they display fine after a member re=uploads their avatar.  Like I said earlier, it wasn't all the uploaded avatars just a few random ones.  That included my own one, I re-uploaded the same one and it shows fine, and a handful of members done the same and they were ok too.  Any ideas?
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: Arantor on November 01, 2013, 12:21:20 AM
I got no idea why they're failing in the first place ;)
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: GL700Wing on November 06, 2013, 07:34:38 AM
Quote from: Arantor on November 01, 2013, 12:21:20 AM
I got no idea why they're failing in the first place ;)
My forum users have also experienced the same issues with IE not always displaying images since the upgrade to 2.0.6 and commenting out the following line in index.php fixed the issue in a few posts I checked:
header('X-Content-Type-Options: nosniff');

After reading this thread (and 2.0.6 upgrade - simple portal block issue (http://www.simplemachines.org/community/index.php?topic=513095.0)) I did a bit of Googling and found the following: IE9 and IE10 does not display CAPTCHA image sometimes (http://code.google.com/p/recaptcha/issues/detail?id=170) and JIRA will not display images with the wrong MIME type in IE due to nosniff header (https://jira.atlassian.com/browse/JRA-30373)

Based on the information in the these two posts about the issue relating to the incorrect MIME type I then checked the value of 'mime_type' in the 'smf_attachment's table for the images that would not display with 'nosniff' enabled and discovered that it was empty.  As the images were 'jpg' images I updated the 'mime_type' field with the value 'image/jpeg' (and re-enabled 'nosniff' in index.php) and after refreshing the page the images displayed!

I then ran the following SQL commands against my database (after making a backup first!) for the different image types and IE is now behaving itself!

UPDATE `smf_attachments` SET `mime_type` = 'image/bmp' WHERE `fileext` = 'bmp' AND `mime_type` = '';
UPDATE `smf_attachments` SET `mime_type` = 'image/gif' WHERE `fileext` = 'gif' AND `mime_type` = '';
UPDATE `smf_attachments` SET `mime_type` = 'image/jpeg' WHERE `fileext` = 'jpg' AND `mime_type` = '';
UPDATE `smf_attachments` SET `mime_type` = 'image/png' WHERE `fileext` = 'png' AND `mime_type` = '';
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: Arantor on November 06, 2013, 08:08:03 AM
Ahhhh, that makes sense, though that should primarily only affect 1.1.x (which doesn't store the MIME type) and early 2.0 (which also didn't), but that does mean it is something the upgrader should fix.

As far as the CAPTCHA goes, it should always be issued with the correct header?
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: GL700Wing on November 06, 2013, 08:41:19 AM
Quote from: Arantor on November 06, 2013, 08:08:03 AM
Ahhhh, that makes sense, though that should primarily only affect 1.1.x (which doesn't store the MIME type) and early 2.0 (which also didn't), ...
I only upgraded from 1.1.18 to 2.0.4 a few months ago and I noticed when I checked the 1.1.18 database a short time ago that the 'mime_type' field wasn't in the 'smf_attachments' table - I figure you'd know when it was introduced to 2.0.  Only recent attachments had the 'mime_type' field populated in the 'smf_attachments' table in my 2.0.6 database.

Quote from: Arantor on November 06, 2013, 08:08:03 AM
... but that does mean it is something the upgrader should fix.
Does that mean I should also set the 'mime_type' for all attachment types (eg, pdf, txt, zip. etc)?

Quote from: Arantor on November 06, 2013, 08:08:03 AM
As far as the CAPTCHA goes, it should always be issued with the correct header?
I don't know - I don't use CAPTCHA.  I only used that link as a reference because it helped me understand the cause of the issue.
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: Arantor on November 06, 2013, 08:46:10 AM
QuoteDoes that mean I should also set the 'mime_type' for all attachment types (eg, pdf, txt, zip. etc)?

It really matters for images, but isn't so important for the non image types. I forget whether SMF itself even bothers for those.
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: GL700Wing on November 06, 2013, 08:54:17 AM
Quote from: Arantor on November 06, 2013, 08:46:10 AM
QuoteDoes that mean I should also set the 'mime_type' for all attachment types (eg, pdf, txt, zip. etc)?

It really matters for images, but isn't so important for the non image types. I forget whether SMF itself even bothers for those.
Thanks for the info - I won't worry about updating the MIME type for non-image file types at this time.
Title: Re: Problem with avatars and attachments in IE after installing 2.0.6
Post by: Scott Hamilton on February 17, 2014, 03:15:34 PM
Quote from: GL700Wing on November 06, 2013, 07:34:38 AM
Quote from: Arantor on November 01, 2013, 12:21:20 AM
I got no idea why they're failing in the first place ;)
My forum users have also experienced the same issues with IE not always displaying images since the upgrade to 2.0.6 and commenting out the following line in index.php fixed the issue in a few posts I checked:
header('X-Content-Type-Options: nosniff');

After reading this thread (and 2.0.6 upgrade - simple portal block issue (http://www.simplemachines.org/community/index.php?topic=513095.0)) I did a bit of Googling and found the following: IE9 and IE10 does not display CAPTCHA image sometimes (http://code.google.com/p/recaptcha/issues/detail?id=170) and JIRA will not display images with the wrong MIME type in IE due to nosniff header (https://jira.atlassian.com/browse/JRA-30373)

Based on the information in the these two posts about the issue relating to the incorrect MIME type I then checked the value of 'mime_type' in the 'smf_attachment's table for the images that would not display with 'nosniff' enabled and discovered that it was empty.  As the images were 'jpg' images I updated the 'mime_type' field with the value 'image/jpeg' (and re-enabled 'nosniff' in index.php) and after refreshing the page the images displayed!

I then ran the following SQL commands against my database (after making a backup first!) for the different image types and IE is now behaving itself!

UPDATE `smf_attachments` SET `mime_type` = 'image/bmp' WHERE `fileext` = 'bmp' AND `mime_type` = '';
UPDATE `smf_attachments` SET `mime_type` = 'image/gif' WHERE `fileext` = 'gif' AND `mime_type` = '';
UPDATE `smf_attachments` SET `mime_type` = 'image/jpeg' WHERE `fileext` = 'jpg' AND `mime_type` = '';
UPDATE `smf_attachments` SET `mime_type` = 'image/png' WHERE `fileext` = 'png' AND `mime_type` = '';

Wow, GL700Wing- this worked great! I ran you query's on my db and everything is working correctly again. Thank you!

Been running the software since the YaBBSE days.. Had this issue for a while now and could not figure it out, you are the man.

Scott