Details
Improvement
Open
Minor
Description
phpBB uses getimagesize() to get image dimensions when setting an off-site avatar or when using [img] if image size limits are enabled.
If you set http://noc.gts.pl/100mb.gts?.gif as an avatar, the server will download a huge file.
It is possible to limit the size:
function getimagesize_limit($url, $limit)
{
global $phpbb_root_path;
$tmpfilename = tempnam($phpbb_root_path . 'store/', unique_id() . '-');
$fp = fopen($url, 'r');
if (!$fp) return false;
$tmpfile = fopen($tmpfilename, 'w');
$size = 0;
while (!feof($fp) && $size<$limit)
{
$content = fread($fp, 8192);
$size += 8192; fwrite($tmpfile, $content);
}
fclose($fp);
fclose($tmpfile);
$is = getimagesize($tmpfilename);
unlink($tmpfilename);
return $is;
}
The size of remote upload should also be limited. The function uses fsockopen, so it's very easy to add a size limit.
Unverified Fix
There is currently no config setting for the max size of an [img]-Image as far as I know from the top of my head.
However, this should definitely work for avatars.