BBCode [IMG] [/IMG ] Tag Vulnerability

<?php 
header("Location: http://<yourdomain.com>/login.php?action=out&id=<your punbb userid>"); 
exit; 
?>

//
// Turns an URL from the [img] tag into an <img> tag or a <a href...> tag
//
function handle_img_tag($url, $is_signature = false)
{
    global $lang_common, $pun_config, $pun_user;

//
// Turns an URL from the [img] tag into an <img> tag or a <a href...> tag
//
function handle_img_tag($url, $is_signature = false)
{
    global $lang_common, $pun_config, $pun_user;
    
    $replace = array('%20',' '); // We don't want spaces in our filenames
    $file = basename(str_replace($replace, '_', $url)); // Get remote filename, excluding pathname
    $expire = '259200'; // How long should we wait to download the image again? Defaults to 3 days.
    $hash = @md5($url); // Generate a MD5 hash of the file(s) URL. Helps prevent multiple copies of the same file.
    $localfile = 'cache/img/'.$file.''; // This is the temp. filename of the local cached copy.
    
    if(file_exists('cache/img/'.$hash.'_'.$file.'') && (time()-filemtime('cache/img/'.$hash.'_'.$file.'') < $expire)) { // Check it image exists, and if it's expired.
        $url = 'cache/img/'.$hash.'_'.$file.''; // Local copy is OK, and not expired, thus we provide don't need to do anything more right now.
    } else {
        $fh = @fopen($localfile , 'w' ); // Prepare for writing
        $remote = @file_get_contents($url); // Get the contents of the remote file
        @fwrite ($fh, $remote); // Write the new file...
        @fclose ($fh); // ...and now we close it.
        rename($localfile, 'cache/img/'.$hash.'_'.$file.''); // The temp file is now uploaded, so let's just rename it before we continue
        $secure = @getimagesize('cache/img/'.$hash.'_'.$file.''); // Check the image dimensions. If we can't find them, it's not an image!
            if($secure == FALSE) {
                @unlink('cache/img/'.$hash.'_'.$file.''); // The file was not an image, so we will have to delete it for security reasons.
                $url = 'img/warning.png'; // We will also provide a warning image. This will show up for any invalid images, or even missing ones.
            } else {
                $url = 'cache/img/'.$hash.'_'.$file.''; // This is a valid image, so we provide the user with a cached copy.
            }
    }

<Limit GET POST>
Order Allow,Deny
Allow from All
</Limit>