r57 shell script

[ewanz]

The shell script allows someone to access your operating system to list, create and remove files and directories as well as execute code on your server. how to prevent it?

[subzero]

dont host a uploader......

or

rename file and let MySql name it

[ewanz]

but what about the site that use lavalair script.. there must be uploader on it.. any tips for it?

[subzero]

when i got time i will code my uploader for lavalair this will be in xhtml

also it be icecube coded

[ewanz]

thanks zero... i also use the url for user avatar.. Is it safety?

[subzero]

edit your bbcode to this

$text = preg_replace("/\[img\=(.*?)\](.*?)\[\/img\]/is","<img src=\"thumb.php?pic=$1&w_max=50&h_max=50\" alt=\"$2\"/>",$text);

$text=preg_replace("/\[img\](.*?)\[\/img\]/i","<img src=\"thumb.php?pic=$1&w_max=50&h_max=50\" alt=\"FAST IMAGE\"/>", $text);

Make page called

thumb.php

<?php 
$pic = $_GET['pic'];

$taille = getimagesize("$pic");  
$h_i = $taille[1];  
$w_i = $taille[0];  
if($h_i >$h_max)  
{  
$convert=$h_max/$h_i;  
$h_i=$h_max;  
$w_i=ceil($w_i*$convert);  
}  
if($w_i >$w_max)  
{  
$convert=$w_max/$w_i;  
$w_i=$w_max;  
$h_i=ceil($h_i*$convert);  
};  

$largeur = "$w_i"; 
$hauteur ="$h_i"; 

header("Content-Type: image/jpeg"); 
list($width, $height, $type, $attr) = getimagesize("$pic"); 

if($type == "1") 
{ 
$img_in = imagecreatefromgif($pic); 
} 

if($type == "2") 
{ 
$img_in = imagecreatefromjpeg($pic); 
} 

if($type == "3") 
{ 
$img_in = imagecreatefrompng($pic); 
} 

$img_out = imagecreatetruecolor($largeur, $hauteur); 
imagecopyresampled($img_out, $img_in, 0, 0, 0, 0, imagesx($img_out), imagesy($img_out), imagesx($img_in), imagesy($img_in)); 
$t = imagejpeg($img_out); 
echo $t; 
?>

[ewanz]

okay i'll try... what the usage of that file? i mean how to use that.. i just put in web folder..is it right?

[subzero]

in main folder.

[ewanz]

i had put in public html/thump.php.. then what must i do?

[ewanz]

i understand.. now <img src=\"thumb.php?pic=$1&w_max=50&h_max=50\" alt=\"FAST IMAGE\"/> insert to avatar...

[subzero]

Yes that right

[ewanz]

i start to make it now.. thanks zero

[riderz]

my lava edit that i have aer secure for uploader ozziemale have posted a code to put in ur uploader folders so it make it more secure

[godzilla]

where is that code?i tried search button but could not find it?

[ewanz]

yeah...give the link.. it could be hard to search..