The secure CMS.
Resources
Topics
- Home
- Development (314)
- Geeklog (209)
- Plugins (108)
- Themes (5)
- News (387)
- Announcements (248)
- Geeklog.net (31)
- Security (76)
- Spam (11)
- Summer of Code (28)
User Functions
Events
What's New
Stories
No new storiesComments last 2 weeks
Trackbacks last 2 weeks
No new trackback commentsLinks last 2 weeks
No recent new linksNEW FILES last 14 days
No new filesWelcome to Geeklog Wednesday, June 19 2013 @ 03:03 AM EDT
Suggestions for filtering CSS url( ) images?
- Thursday, January 30 2003 @ 06:19 AM EST
-
- Contributed by:
- sardu
-
- Views:
- 13,403
While playing with what sorts of HTML I could include in a message I managed to get a logo to appear overtop of the site logo via a CSS url() call. Neat thought it was a neat hack personally but now I've got potential clients ("suits") who are concerned about having porn added to their sites.
There is an example in this message, you should be able to see an example image just under the Geeklog logo in most browsers.
It only takes a few minutes of playing with this to see how much stuff you can do with it. (Using position:fixed; can be really annoying)
I was just going to add a bunch of eregi() calls but thought I'd ask around here first for opinions/suggestions/comments on filtering out stuff like this without crippling GeekLog's HTML inclusion facility.
Editors note: here is the example code:style="position:absolute;top:100px;left:100px;
width:200px;height:101px;z-index:100;
background-image:url('http://www.example.com/someimage.gif');
border:0;margin:0;padding:0;display:block"
--
Lucas Thompson
sardu@mac.com
The following comments are owned by whomever posted them. This site is not responsible for what they say.
Now you see why I want to fix this : )
---
Lucas Thompson
sardu_AT_mac.com
Thnx!
---
Danny @ squatty.com
It _DOES_ work on some other weblog sites/packages. I'm not going to list any of them here. I think a fix should probably be applied to the main distribution.
It has nothing to do with apache or php, if you let HTML attributes pass through, other people's browsers will render them. If those attributes contain CSS, the browser will render the CSS.
---
Lucas Thompson
sardu_AT_mac.com
---
The reason people blame things on previous generations is that there's only one other choice.
I'll see if I can minimize the regex in favour of str_replace()
---
Lucas Thompson
sardu_AT_mac.com
It works fine and preg_replace seems quick enough even on an ancient K6/350 I have.
Please note that it prevents ALL user-generated CSS from appearing.
---
Lucas Thompson
sardu_AT_mac.com
Doh!... that actually only fixes it if the user writes nice clean HTML with no spaces before/after the = sign.
I'm thinking maybe phpfilter should be integrated instead, it still lets images from the main site get loaded (allowing you to disable a page with a 2000x2000 pixel repeating pattern of the site logo) but I've contacted the author about it.
Anyone have other suggestions?
---
Lucas Thompson
sardu_AT_mac.com
<TAG style="position:absolute;top:N;left:N;width:N;height:N;z-index:100;background-image:url('http://www.example.com/someimage.gif');display:block" TAG>---
Lucas Thompson
sardu_AT_mac.com
http://sourceforge.net/tracker/index.php?func=detail&aid=678507&group_id=7371&atid=107371
---
Lucas Thompson
sardu_AT_mac.com