Discourse Signatures

Plugin
,
187

Am I crazy here or is there no validation on the user input signature image URL at all?
Basically a user can input whatever they want and it will be pushed to other users?

Also, why is the URL signature db size set to 32_000?
Why would anyone need 32000 characters for a URL to an image?

Spooky :ghost:

I modified the css to this in order to hard code a max height and width;

.signature-img {
  max-width: 600px;
  max-height: 100px;
  width: auto;
  height: auto;
  display: block;
  margin: 5px 0;
}

I changed signature URL max size to 250 in plugin.rb

  register_user_custom_field_type("signature_url", :string, max_length: 250)
  register_user_custom_field_type("signature_raw", :string, max_length: 250)

I added this to the bottom of “on(:user_updated) do |user|” in plugin.rb (I won’t be using advanced mode)

    # Validate the URL if not in advanced mode
    if !SiteSetting.signatures_advanced_mode && user.custom_fields["signature_url"]
      url = user.custom_fields["signature_url"]

      # Strict validation: only HTTPS, only certain image file types
      unless url =~ /\Ahttps:\/\/[a-zA-Z0-9.\-\/_]+\.(png|jpe?g|gif|webp)(\?[a-zA-Z0-9=&]+)?\z/
        Rails.logger.warn("[discourse-signatures] Rejected invalid signature_url for user #{user.id}: #{url.inspect}")
        user.custom_fields["signature_url"] = nil
        user.save
      end
    end

If I’m doing anything wrong here (Never worked with Discourse before), please correct it and show me the right way to do it.

1 Like
188

Because 250 is not enough…

This is the whole idea of a signature. Same thing goes for a forum, people input stuff and other people get to see it. Crazy world huh?

5 Likes
190

When Discourse is upgraded to 3.5.0.beta8 (3.5.0.beta9-dev is also a problem), it is found that the user edited the signature and cannot save it (although it shows saved but does not take effect), it is still normal on 3.5.0.beta7. Hope to fix it soon, as many plugins from beta7 to beta8 are built-in.