1

(2 replies, posted in PunBB 1.2 discussion)

Thanks for the quick answer. You guys are great.

Hi,

Does PunBB perform validation on uploaded avatars?

The reason I ask is because I had a YaBB board back in the day where someone forged an image's mime type and was able to execute a php script similar to phpshell. This is also the only user accessible place on my site that allows for uploads.

I'm sure this has already been addressed, but I would feel better knowing the answer.

Thanks in advance,
Kyle

I'll just edit this since it wasn't PunBB's fault.

If you receive a 503 error when uploading avatars, your host may have mod_security enabled. It will look something like this:

503 Service Temporarily Unavailable
The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.

The resolution is to disable it using a .htaccess file from here:
http://www.vbulletin.com/forum/showthread.php?t=197290

Regards