Question [Merged topic] Dynamic images in Kunena

Hi,

my Kunena users want to display some images in their signature. But it's not a static image like "myimage.jpg", its a dynamic generated image, rendered by various GET parameters in the image URL.

Here's an example:
Unfortunately, Kunene doesn't display the image, it's showing this instead:
What's going wrong?
Have a look at the "&" in the GET parameters - its getting encoded (htmlentities). Perhaps this is the cause?!? But how to fix this to display the image?

Best regards
Krümelbrot

Hello,

For security reasons, you can't display this kind of image in Kunena, you need to use standard image with an extension (.jpg, .png...)

Hi,

thanks for your response.
Can you provide some kind of workaround if I feel up to run the risk of this security reason?

If there is a workaround, does it affect just the images in the signature?

Thanks and best regards
Krümelbrot

Any workaround will expose your site to be compromised. If you allowed scripted, on-the-fly images, you allow scripting. If you allow scripting you allow the possibility that anyone can hijack your site and you've lost control. So, if you want to allow script-injected exploits of your site, you can modify the open-source Kunena code to do these things. The standard Kunena source code prevents the exploit. The choice is yours.

I, personally, do not know what you need to change. I'm only aware of the risks and for me, personally, I'm not willing to jeopardise my sites or compromise my reputation (or the reputation of this great team of developers) by showing people how they let people crash their websites. If on-the-fly scripted images are an essential part of your business then there are plenty of forum alternatives that allow you the means to do those things. We also know that there are significant security concerns with those other forum alternatives because of those things.

Is there any option to make them visible?

uk.advfn.com/p.php?pid=staticchart&s=ASX^MTE&p=0&t=1

Example Image-Source:

If I take an image tag, it does not work.
Or the code is changed after Submit as a Url

uk.advfn.com/p.php?pid=staticchart&s=ASX^MTE&p=0&t=1 ]

uk.advfn.com/p.php?pid=staticchart &s=ASX^MTE&p=0&t=1

I wonder what else this switch is for in Backend configuration (BB-Code)

Found a but where urls got escaped one times too much resulting & instead of &. Fixed it to next version.

Fix can be found from here:
github.com/Kunena/Kunena-1.6/issues/69