AvataruploadcanbeusedtoleakserverIP

Explanation

I'm a big fan of services like Cloudflare but I've noticed the way Flarum handles avatars allows anybody to leak the server IP.

When registering or updating your user settings, you can pass an

attribute that will be downloaded and set as avatar.

This looks deliberate, however this allows any user to ask the server to perform a request to any given url.

Maybe this should be limited to admins or controlled via a permission ?

Technical details

• Version of Flarum: master

Both

and

allow the use of

without restrictions.

该提问来源于开源项目：flarum/core