New users can paste images in post and not trigger automatic moderation

[Snowhog]

vBulletin Version:
- 5.7.0

PHP Version:
- 7.4.32

Database Version:
- 8.0.31

Issue Description: (Include error message(s), if any)
- New users can paste images in posts

Affected Browser(s):
-

Steps to Reproduce: Expected Result:
- New users should not be able to include pasted images in posts

Actual Result: (Include screenshot(s), if possible)
-

Registered User usergroup is where all our new registered members get assigned. When they have made three approved posts, they are moved (by Promotion) to Established usergroup, where additional permissions are granted.

New users can paste images in their posts because there isn't a permission in this usergroup that controls doing so. Unacceptable images can therefore be included, ex: porn.

How can we prevent pasted images from being included in new user posts?

[glennrocksvb]

Pasted images like normally uploaded images are attachments. Check the attachments-related permissions (e.g. Can Create Attachments) in the usergroup.

[glennrocksvb]

Also check "Skip Moderation for Posts/Topics With Attachments" permission

[Snowhog]

As you see above, Can Create Attachments is set to No, yet pasted images can be included; I did just that with my test user. I have screen shots of the sequence of events if you want to see them.

Skip Moderation for Posts/Topics With Attachments

That is set to Yes. I'll change that to No.

[Snowhog]

Even after setting "Skip Moderation for Posts/Topics With Attachments" to No, and logging in with my test user, I was able to create a first post with a pasted image:



The post doesn't get flagged as requiring Moderation.

The user can see the post and its content. Guests can see the post and its content. HOWEVER, when I log in with my normal user (happens to be an Administrator), the post is identified in the list of topics/posts in the forum it was made in, but when I open it, the pasted image is NOT visible:



BUT, when I click on Edit, the pasted image is visible:



Why is this happening?

[glennrocksvb]

This seems to be a bug. When you look at the topic list, can you see the Attachment icon (clip) near the Statistics column for the corresponding topic with pasted images? If so, then the pasted images are considered "attachments".

[glennrocksvb]

Does it work if you attach the images normally?

[Snowhog]

Does it work if you attach the images normally?

Attempting to attach an image results in:


"You cannot upload attachments in this channel"

This is the issue; using the function to 'attach' an image results in being denied (what we want), but copy/pasting an image isn't blocked (not what we want). Copy/Paste of an image bypasses the 'rule'.

[glennrocksvb]

Try also setting "Maximum Attachments per Post" permission to 0.

[Snowhog]

When you look at the topic list, can you see the Attachment icon (clip) near the Statistics column for the corresponding topic with pasted images?

No.

And interestingly, I just logged out (as my Admin user) and viewed our Forum as an unlogged in Guest. Looking at the topic list for the post I made (as my 'new' user), there is also no attachment icon. And even more interesting, when I actually view the post, the image still isn't visible. But if again, I log in as my normal user (an Administrator), viewing the post doesn't show the pasted image. If I edit the post, the image is shown.

[Snowhog]

Try also setting "Maximum Attachments per Post" permission to 0.

Done. I'll test another post to see if I can paste an image.

[Snowhog]

I can still paste an image in a new post with my testing user.

[glennrocksvb]

Try setting the "Space (in bytes) that a user's total attachment usage may consume" option to 1 (byte). Setting 0 means unlimited so just try 1.

[Snowhog]

Try setting the "Space (in bytes) that a user's total attachment usage may consume" option to 1 (byte).

Okay, made that change. I'll try anther post in a bit.

Something is really flaky! The first post I made wasn't showing the pasted image when I (as logged in Admin user) viewed the post, but was visible if I edited the post. But I logged in as the test user, and when I viewed the post, the image was visible. I then logged out and back in as my Admin user. I viewed the post and the image WAS visible, without having to edit the post!

[Snowhog]

The 'rabbit hole' on this issue goes deeper still!

I was just informed by one of our other Admins that he can't see the images in the posts I made! WTF! I see them!!

[glennrocksvb]

Maybe time to update to 5.7.2