Search code examples
phpimagerandomforum

Random image creating script trouble

I have created a script which takes a random IMAGE ID from the database, converts it to a valid file name and then I use it to generate random images from a link.

This is how such a link looks like (works - try it): http://imgit.org/roll.php?image=3J9N0Y4k8g4l4G7

When you reload that link, you'll notice the image changes. If I add this image to <img src="THAT LINK" /> it works, however, it doesn't work on message board like phpBB or vBulletin when I put that link inside [img][/img] BBCode tags.

I suppose there is a problem with my script, because there are various services out there that do exactly the same thing (link on forums) and it works.

Here is my roll.php script:

<?php

$imgit_root_path = '.';
include("{$imgit_root_path}/common.php");

if ($config['disable_roll'])
{
    redirect('index.php');  
}

$roll_key = request_var('image', '');
$roll_key = substr($roll_key, 0, 15);

if (!$roll_key)
{
    redirect('index.php?action=404');   
}

if (!$image->roll_key_exists($roll_key))
{
    redirect('index.php?action=404');   
}

$images = $image->roll_info($roll_key);
$images = explode('|', $images);

$count = sizeof($images);
$index = mt_rand(0, $count - 1);

$extList = array();
$extList['gif']  = 'image/gif';
$extList['jpg']  = 'image/jpeg';
$extList['jpeg'] = 'image/jpeg';
$extList['png']  = 'image/png';

$image_url  = generate_site_url() . IMAGES_PATH . $image->get_name($images[$index]);
$image_inf  = pathinfo($image_url);

header('Content-type: ' . $extList[$image_inf['extension']]);
readfile($image_url);
?>
Solution

  • I believe the problem may be that phpBB will disallow links which aren't confirmed as images. That is, don't have a known image extension, such as .jpg;

    https://www.phpbb.com/community/viewtopic.php?f=46&t=1285255

    For security reasons, images whose extensions cannot be confirmed (such as in the first example) aren't allowed by BBCode. Instead of an image, it's fully possible for someone to embed a JavaScript script, or even worse, onto a page which could be a security risk to anyone visiting the page, or possibly even the server.

    This is most likely the same in vBulletin.

    Seems you can override it in the forum settings maybe?

    Alternatively, if you can change you script, so that you can append a ".jpg" extension to the end, then that may also work!