PhpThumb: configuration and security mode

Hello,

I have a couple of questions about phpThumb:
- for a production site does it require a specific configuration or the default one is safe enough?
- I'm trying to enable the "high_security" mode but I stll have problems with the hash [it says it's missing]. I wonder that's because both the flexicontent component and modules are not calling the function in the proper way to use the "high security" mode.

Do you have any infos about these "issues"?

thank you so much
sg

Hello

phpThumb version included with FLEXIcontent does not have any known security issue that would allow an attaker to modify or write PHP files, or otherwise hack a websote
- it will only read and thumbnail images
- also by default configuration , it will not thumbail images ABOVE document ROOT thus your website statistics images, and image of other websites, are safe from being stolen

but some can use phpThumb to steal copyrighted images
- that if the images are inside a folder that is NOT protected via .htaccess

so e.g. if you disable htacess protection for images uploaded via image field in folder mode then
even if you have watermark in your thumbnails, someone can use phpThumb thumbnail and download the image without the watermark

ok, great.

thank you so much

Hello

also about high security mode to make security more tight,
we will make use of it in future
- if a PHPThumb vulnerability is discovered in the future, or some other server related vulnerability is discovered,
then it will not be possible to be used if the web-site is using "high security mode"

- this is newer feature of PHPThumb

it makes impossible to use URLs that are not created by a specific function,
- aka you cannot just type urls in the browser

but this will break any older custom using such URLs
- the idea is to make a component parameter for it

And also update our templates and enable it by default for new web-sites

Hello

so will make a parameter for it,
i have opened a new issue for it: (3.0.15 / 3.0.16)
github.com/FLEXIcontent/flexicontent-cck/issues/508