WS500 and PHP Image Resizing

Hello taekwanleap,

the URL in your thumbnail link is incorrect (it contains an extra http// ) - but this is a typo.

Now I'd guess that the relative path (../../../) is causing the problem. I don't have an appliance so I can't say if and how you can see the request the WS500 is sending.

Christian 

 Thanks for the reply.  Yes - it was a typo and I went back and thought I corrected the typo.

Thanks for pointing out the relative path.  I had noticed that in the URL but did not think much about it - but now you have pointed it out - I will see if I can get the exact path and see if I can get to it and it make a difference.

Here is what is really weird.

This is the URL of the small thumbnail image not showing:

http://www.mentalhelp.net/common/classes/thumbnails/show_image.php?filename=../../../images/root/alcohol2.jpg&width=45&height=45

This is the link entry in the reports and it says it is allowed.  If I put this link into my browser I get a "Web page cannot be found." error message.

http://www.mentalhelp.net/common/classes/images/root/alcohol2.jpg

But if I click on the article I can see the full size image.  It's URL is: http://www.mentalhelp.net/images/root/alcohol2.jpg

Here is the report when I visit the website.  Notice all the URL's with /common/classes being allowed?  These say "Web page cannot be found" if I click on them.

I think the ../../../ is incorrectly rewritten to yield these URL with /common/classes . This is the path for show_image.php and it need the parameter (filename=) as it is written.

I can only imagine that the following occurs:

The /../.. is interpreted as "up two directories, thus "consuming" the two path parts (/thumbnails/show_image.php?filename=.. ) before it and you get the invalid URL.

Christian

Looks like I need to place a call into Sophos to get them to see if they can watch what happens in real time.  What I am thinking is with the image.php making the full size image a thumbnail - it probably appears to the web appliance as malicious code/script running since this is an unusual way of making a thumbnail - probably better ways for them to do what they are wanting - but this is how they are doing what they are - so it is what it is.

Thanks for your help QC!

When I get a chance to call Sophos and they can watch what happens in real-time and get some answers - I will definitely post the results!

Thanks again!

The image.phpruns on the mentalhelp server, not in your browser. What it apparently does is resizing an image to thumbnail size (but keeping the original aspect intact - guess that's why they do it this way instead of coding it in the <img> tag). The reply on the (correct) request is

HTTP/1.1 200 OK
X-Powered-By: PHP/5.2.10
Content-Type: image/jpeg
Transfer-Encoding: chunked
Date: Fri, 01 Jul 2011 13:33:10 GMT
Server: lighttpd/1.4.25

 and returns an image with 2588 bytes and 23*45px.

The WS500 (and it is probably interfering) mangles the URL as it seems to get confused by the "up one level" notation (../) . 

... and - don't mention it

Christian

Hi taekwanleap,

Unfortunately, this sounds very much like a recently discovered defect, where in rare circumstances the appliance doesn't parse the requested URL correctly.

The defect only occurs in bridged/transparent mode - if you are using the appliance explicitly then this shouldn't happen.

We are planning to fix this in an upcoming release, although I don't have a date for this yet.  If you would like more info I'd recommend to call our support team - the internal reference for the bug is DEF70511 .

Thanks,

Tom.

Thanks Tom.  I have a call into Sophos Tech Support now.  They are looking into it.  I will reply the information you have supplied.

Thank you!