phpBB 3.3.17 uses the bundled Plupload/mOxie image handling code when JPEG attachments are resized in the browser.

During a client-side JPEG resize, Plupload reads the original JPEG APP segments before re-encoding the image through canvas. It then restores the preserved APP headers into the newly generated JPEG.

The current mOxie code preserves APP1 through APP15, including APP4. APP4 can contain vendor-specific or proprietary metadata that is unrelated to the newly re-encoded image pixels and is not required for standard EXIF orientation handling.

As a result, an APP4 segment from the original image can remain present in the resized attachment even though the JPEG pixel data has been regenerated.

Steps to reproduce

1. Use phpBB 3.3.17 with client-side attachment image resizing enabled.

1. Use a JPEG containing an APP4 segment.

1. Configure the maximum image dimensions so that Plupload performs a client-side resize.

1. Attach and upload the JPEG.

1. Inspect the JPEG markers of the resulting uploaded image.

Actual result

The original APP4 segment is copied back into the newly re-encoded JPEG.

Expected result

APP4 should not be re-injected into a JPEG produced by client-side resizing.

Other required or currently supported JPEG metadata segments should continue to follow the existing header-preservation behaviour.

Technical details

The bundled mOxie JPEG header parser currently preserves every APP marker from APP1 through APP15.

A working modification excludes marker 0xFFE4 (APP4) from the list of headers that are restored after the canvas re-encode.

This is a small and isolated change to the JPEG header-preservation path and does not modify the image pixels or normal upload behaviour for files that are not resized.