Question [Solved by hack] JoomGallery IMG tags don't work in Kunena

Hi all,

I have some problem with inserting images into Kunena posts.
It doesn't interpret the bb code correctly, my code looks like (comes from Joom::Gallery):
[IMG] advpoland.com/index.php?view=image&forma...oomgallery&Itemid=54 [IMG]
and as you see there is only code/text, not image visible.

Can anyone help to solve this?

Regards,
Radek

Hello,

This is an image url not convnetional, an image url which will be parse correctly is :

www.kunena.com/components/com_kunena/tem...ages/kunena.logo.png

I don't know joomgallery, maybe there is a way to generate other kind of urls.

I think this is a direct bug. (edit; even though its a security measure)

There are PLENTY of galleries and sites out there, that serves images by url parameters through scripts. :S (and there are plenty of reasons to do so)
We cant dictate how the url should be on every image on the web.

radekgorski,
[strike]Have you tried cutting down your image url to see which part makes the trouble?[/strike]
Have you tried if the url is working on other forums that supports bb-code? (if so, which?)

Edit; A whitelist pattern, as someone kindly suggested, would deal with some of these issues, but lets see if its doable first...

I use JoomGallery ( www.en.joomgallery.net/ ). The Joomgallery IMG tags do not work in Kunena.

You can't display JoomGallery images in the forum because they are built on-the-fly with PHP. You can, however, post a link to your gallery, like this: Here's the picture!

Gentlemen,

You are hitting a security barrier we have built into kunena.

The problem is that all browsers will perform a GET request on any URL placed inside of html < img > tags (ad therefor coming from [ img ] tags).

In the case of a gallery this is the right thing to do, unfortunately hackers around the globe have learned to misuse this in various ways.

A very simple and none critical misuse would be to stick the url of the logout link into and [ img ] tag. Whenever somebody gets to look at that page, the logout would get executed. Now a logout is nothing extremely ugly, but you get the point, you can do a lot of other things.

Therefore Kunena performs a security check if the [ img ] tag truly contains an image file by looking at file name and extension.

We are discussion on how to provide an override feature that would allow you to whitelist certain urls or domains.

sozzled wrote:

... however, post a link to your gallery, ...

I know, I can post the link but I need pictures to be displayed.
Take a look here, some solution (Joom::Gallery forum):
www.forum.en.joomgallery.net/index.php?topic=2586.0

Regards,
Radek