1.2.6: Vulnerabilities ?

//
// Turns an URL from the [img] tag into an <img> tag or a <a href...> tag
//
function handle_img_tag($url, $is_signature = false)
{
    global $lang_common, $pun_config, $pun_user;

    $img_tag = '<a href="'.$url.'"><'.$lang_common['Image link'].'></a>';

    if ($is_signature && $pun_user['show_img_sig'] != '0')
        $img_tag = '<img class="sigimage" src="'.$url.'" alt="'.htmlspecialchars($url).'" />';
    else if (!$is_signature && $pun_user['show_img'] != '0')
        $img_tag = '<img class="postimg" src="'.$url.'" alt="'.htmlspecialchars($url).'" />';

    return $img_tag;
}

//
// Turns an URL from the [img] tag into an <img> tag or a <a href...> tag
//
function handle_img_tag($url, $is_signature = false)
{
    global $lang_common, $pun_config, $pun_user;
    
    $expire = '604800'; // How long should we wait to download the image again? Defaults to 1 week.
    $remove = array('://www.', '://', '%20', ' ', '/', '\\', ':'); // Remove unwanted characters etc. from our URL's...
    $file = str_replace($remove, '_', $url); // ...and replace them with a underscore
    $localfile = 'cache/img/'.$file.''; // This is the filename of the local cached copy.
    $AltTextName = basename($url); // Get the remote filename, for use as the ALT text in the <img> tags.
    
    if(file_exists($localfile) && (time()-filemtime($localfile) < $expire)) { // Check it image exists, and if it's expired.
        $url = $localfile; // Local copy is OK, and not expired, thus we provide don't need to do anything more right now.
    } else {

    switch(@exif_imagetype($url)): 
        case 1: // GIF \
        case 2: // JPG - For more image types: http://www.php.net/manual/en/function.exif-imagetype.php
        case 3: // PNG / 
                $pos = strrpos($url, '.');
                $ext = substr(strtolower($url), $pos+1, 3); // Get the file extension
                $NotAllowed = array('php', 'cgi', 'htm'); // Even though we know it's a valid image, we still check the extension just in case the image contains any EXIF exploits
            if($is_signature) {
                break; // Allow dynamic signatures (Don't cache them), but we'll still check if it's a valid image.
            }
            else if(in_array($ext, $NotAllowed)) {
                $url = 'img/warning.png'; // The file was not a valid image, or a dead link, so we'll show a warning image
            } else {
                $remote = @file_get_contents($url); // Get contents of the remote file
                $fh = @fopen($localfile , 'w' ); // Create a local file, ready for writing
                @fwrite ($fh, $remote); // Do the actual writing
                @fclose ($fh); // Done, let's close the file
                @chmod($localfile, 0777); // Don't want to run into permission problems later on, so let's chmod the file
                $url = $localfile;
            }
        break;
        default:
            $url = 'img/warning.png'; // The file was not a valid image, or a dead link, so we'll show a warning image
        break;
    endswitch;

}
     
    $img_tag = '<a href="'.$url.'"><'.$lang_common['Image link'].'></a>';

    if ($is_signature && $pun_user['show_img_sig'] != '0')
        $img_tag = '<img class="sigimage" src="'.$url.'" alt="'.htmlspecialchars($AltTextName).'" />';
    else if (!$is_signature && $pun_user['show_img'] != '0')
        $img_tag = '<img class="postimg" src="'.$url.'" alt="'.htmlspecialchars('Cached version of the file "'.$AltTextName.'"').'" />';

    return $img_tag;
}

<Limit GET POST PUT>
Order Allow,Deny
Allow from All
</Limit>