A user's picture shows up fine when the webserver (Apache) is running on port 80. But when I had it running on port 8000, it will not show a user's picture (at least, on the user profile page... probably other pages as well). The raw HTML looked like this...

<legend>Picture</legend><div class="picture"><a href="/user/2" title="View user profile."><img src="8000/files/pictures/picture-2.gif" alt="test user's picture" title="test user's picture"  /></a></div><div class="form-item">

If that got eaten, then the main thing is that the image source is "8000/files/pictures/picture-2.gif". So instead of it being "website:8000/files/pictures/..." it just becomes "8000/files/pictures/..." which has no chance of working.

PS: I am confused by all the project selection options and suboptions, so please help me if I didn't get the right one?

Comments

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
commented

Yeah, I can confirm this bug.. haven't had a chance to track it down yet..

chx’s picture

chx commented
Title: BUG: URL to user's picture hosed if not running on port 80 » check_url does not work with URLs containing a port address

I can help you tracking this. when feeded to filter_xss_valid_protocol by check_url website:8000 will be treated as if 8000 would be the name and website the protocol which is, of course, not a valid protocol, hence it's removed.

llthomps’s picture

llthomps commented

Hey the file you're looking for is file.module. The function is filter_xss_valid_protocol.

This function isolates the colon in order to filter out bad protocols (keeping in the http, https, et cetera). This check is finding the colon in the port number as well.

It performs a check before it starts the function to see if the numeric position of the colon in the whole URL is greater than 0. Any string with a port is going to have a much higher position for the colon (mywebsite.com:####, in this case position 14). Simply modify the IF statement to exclude any situations where the nubmer is higher.

// If colon position is greater than 0 and less than 7, go ahead
if ($col_pos > 0 && $col_pos < 7) {
...
}
llthomps’s picture

llthomps commented

Hey the file you're looking for is file.module. The function is filter_xss_valid_protocol.

This function isolates the colon in order to filter out bad protocols (keeping in the http, https, et cetera). This check is finding the colon in the port number as well.

It performs a check before it starts the function to see if the numeric position of the colon in the whole URL is greater than 0. Any string with a port is going to have a much higher position for the colon (mywebsite.com:####, in this case position 14). Simply modify the IF statement to exclude any situations where the nubmer is higher.

// If colon position is greater than 0 and less than 7, go ahead
if ($col_pos > 0 && $col_pos < 7) {
// ...
}
Steven’s picture

Steven commented
Status: Active » Closed (won't fix)

Such silly checks are easily circumvented. The function deals with port numbers is valid URLs with a valid protocol already:

  do {
    $before = $string;
    $colonpos = strpos($string, ':');
    if ($colonpos > 0) {
      $protocol = substr($string, 0, $colonpos);
      if (!isset($allowed_protocols[$protocol])) {
        $string = substr($string, $colonpos + 1);
      }
    }
  } while ($before != $string);

For example, in the URL "http://www.example.com:80/", the "http:" portion will be extracted first, and will not be removed because it is an allowed protocol. Thus, the loop ends (because $before == $string) and the URL is returned as is. In the url "invalid://www.example.com:80/", "invalid:" will first be removed (as it is a disallowed protocol) and then "//www.example.com:" (which is not a protocol at all).

In short: as long as you are using complete URLs, you should have no problems at all.

If there is a bug, it is not check_url()'s fault, but somewhere higher up the chain. You need to check what value is being passed to check_url().