When using IE8 and clicking on an image attachment on here it prompts you to download it instead of opening it in a new tab like Firefox does. I have noticed that this issue does not appear on other forum softwares in IE8.
I believe that's on purpose and a security change for mybb as of version 1.4.4 I think? There is an exploit in IE and to fix it many software developers were forced to make changes to their scripts.
That is weird. It sure is annoying to have to open each attachment with a prompt to download or open the file.
Hate to bug about this but could a developer please comment on why this was done and if they forsee in the future this behavior changing? This is not the default behavior on many forums I visit. It is really annoying to not have it open in another tab in IE8.
As labrocca said, it was an IE security issue. It wasn't originally planned to be line this, hence why it only affects IE. It was done for security, not to annoy people
Mind you too this is a security problem with all scripts and IE not just Mybb. Mybb is just smart enough to deal with it. Some scripts have decided to leave the vulnerability.
(2009-06-22, 07:12 PM)MattRogowski Wrote: [ -> ]As labrocca said, it was an IE security issue. It wasn't originally planned to be line this, hence why it only affects IE. It was done for security, not to annoy people
(2009-06-22, 07:14 PM)labrocca Wrote: [ -> ]Mind you too this is a security problem with all scripts and IE not just Mybb. Mybb is just smart enough to deal with it. Some scripts have decided to leave the vulnerability.
Ok. It's not that I didn't believe labrocca I was just looking for a bit more of an explanation of the security issue as MyBB is the first time I have run into this problem.
Correct me if I am wrong but I believe the security was that sql injections could be passed through a tab opening an image.
I have a question related to the topic, I have a mod I am porting that uses screenshots and it opens them in a new tab, will I need to recode it to open a download for IE8 as well?
(2009-06-22, 09:23 PM)Steve Moore Wrote: [ -> ]Correct me if I am wrong but I believe the security was that sql injections could be passed through a tab opening an image.
The exact details are a possible XSS injection and only if the user actually canceled the image attachment before it finished downloading, and that the hacker was able to write a malicious script that bypassed the image verification procedures. (It gets technical from here...)
Ah ok thanks Ryan for the correction, I wasn't sure of the issue but I knew it was an injection.
Does that mean I need to have my images for my mods open in a download or can they still open in a new tab?