Chrome malware warning

[conspirosphere.tk]

Wonder why today I am getting this while browsing the forum?

[terrytibbs]

It's ineededausername's avatar. It looks like the site has been compromised or something.

<td valign="top" width="16%" rowspan="2" style="overflow: hidden;" class="poster_info">
   <b><a href="https://bitcointalk.org/index.php?action=profile;u=40007" title="View the profile of ineededausername">ineededausername</a></b>
   <div class="smalltext">
      [...]
      <div style="overflow: auto; width: 100%;"><img src="http://www.mstrum.com/onmywaytokorea/wp-content/uploads/2009/07/north-korean-propaganda-other-7.jpg" width="120" height="80" alt="" class="avatar" border="0"></div><br>
      Defender of the motherland... I mean Bitcoin
      [...]
   </div>
</td>

On a related note, Jesus Christ this forum needs new software.

[BadBear]

It might be best to require all avatars to be locally hosted on the forums, it would stop this and the people who have 1.3 MB avatars (same guy i think). 

[theymos]

I changed it so avatars given as URLs are downloaded, resized, and hosted by the forum. This will only apply to future avatars.

[rjk]

I changed it so avatars given as URLs are downloaded, resized, and hosted by the forum. This will only apply to future avatars.

I like this, although I suspect that the people using dynamic avatars from Bitminter et al won't. I wonder if it is possible to "whitelist" those. Also, I doubt the resizer will handle gifs, will it? Not that I care lol.

[theymos]

I like this, although I suspect that the people using dynamic avatars from Bitminter et al won't. I wonder if it is possible to "whitelist" those. Also, I doubt the resizer will handle gifs, will it? Not that I care lol.

I'll see how many people complain. Those dynamic images seem unnecessary, though I guess whitelisting could be done if absolutely necessary.

Animated GIFs do not retain their animation when resized. I think you can still upload them if they're already correctly-sized.

[Remember remember the 5th of November]

And another good deed done.

[Red Emerald]

One more thing to make sure my forum handles properly.

[ineededausername]

derp, I'll go change it

[theymos]

derp, I'll go change it

I already fixed it for you by uploading it to bitcointalk.org.

[Remember remember the 5th of November]

derp, I'll go change it

I already fixed it for you by uploading it to bitcointalk.org.

But what if the image was infected.

[rjk]

derp, I'll go change it

I already fixed it for you by uploading it to bitcointalk.org.

But what if the image was infected.

Oh noes, virisses be infectin mah jaypegs.

[Red Emerald]

derp, I'll go change it

I already fixed it for you by uploading it to bitcointalk.org.

But what if the image was infected.

Oh noes, virisses be infectin mah jaypegs.

I know there has been arbitrary code executed by PNGs.  That's how one of the iphone jailbreaks worked (after the TIF and then PDF exploits that worked similarly IIRC).

I'm pretty sure resizing the image would kill any malicious behavior (if any at all).

[mcorlett]

I changed it so avatars given as URLs are downloaded, resized, and hosted by the forum. This will only apply to future avatars.

What are the specific constraints (in pixels, please)?

[theymos]

What are the specific constraints (in pixels, please)?

120px × 80px