YUI Security Issue found in uploader.swf ?

[Mark.B]

What has been lost or is not working? As you should not need to have users back on the old style basic attachment uploader - you should still be able to use the newer "Asset Manager".

If you would like to raise a support ticket with AdminCP credentials we will have a look at how you have things configured as the old attachment manager should not be there unless a user specifically opts for it.

http://www.vbulletin.com/go/techsupport

[Art Andrews]

Mark, what has been lost? The ability to easily and simply upload multiple images. It is undeniable. Our members were able to click the insert image button and very quickly and easily upload images. While clicking into the Asset Manager is a bit more tedious, you could still relatively easily upload multiple files.

Now, you can't upload multiple files from the Insert Image button at all (functionality lost) and from the Asset Manager, you have to go through a slow and tedious file by file selection (functionality lost.) While I am not onboard with Dirtrider's particular approach, his basic argument is absolutely correct. For any forum that is image-heavy, we have been ham-strung. Can we upload photos? Yes. Can we do it in a quick and easy way? Absolutely not. We have lost the ability to do that. We are now stuck with a very awkward and clunky means of uploading and vB has made it clear it has no interest in doing anything about it. What does this mean? Our members will be discouraged from uploading photos, especially because they know it WAS easy and now is not.

I have to believe the only reason there isn't a greater outcry about this is that many simply haven't "patched" their servers yet.

[Mark.B]

Mark, what has been lost? The ability to easily and simply upload multiple images. It is undeniable. Our members were able to click the insert image button and very quickly and easily upload images. While clicking into the Asset Manager is a bit more tedious, you could still relatively easily upload multiple files.

Now, you can't upload multiple files from the Insert Image button at all (functionality lost) and from the Asset Manager, you have to go through a slow and tedious file by file selection (functionality lost.) While I am not onboard with Dirtrider's particular approach, his basic argument is absolutely correct. For any forum that is image-heavy, we have been ham-strung. Can we upload photos? Yes. Can we do it in a quick and easy way? Absolutely not. We have lost the ability to do that. We are now stuck with a very awkward and clunky means of uploading and vB has made it clear it has no interest in doing anything about it. What does this mean? Our members will be discouraged from uploading photos, especially because they know it WAS easy and now is not.

I have to believe the only reason there isn't a greater outcry about this is that many simply haven't "patched" their servers yet.

I know in the Flash uploader you could control + click multiple attachments and upload the lot. I agree this was handy, though technically it wasn't built to do that, it's just that the use of Flash got round the way the uploader was built. vB attachments were always intended, rightly or wrongly, to be selected individually.

Sadly without Flash there's no way to get it to do multiple "selection" again, however ,multiple "uploads" are still possible.

[DirtRider]

I know in the Flash uploader you could control + click multiple attachments and upload the lot. I agree this was handy, though technically it wasn't built to do that, it's just that the use of Flash got round the way the uploader was built. vB attachments were always intended, rightly or wrongly, to be selected individually.

Sadly without Flash there's no way to get it to do multiple "selection" again, however ,multiple "uploads" are still possible.

Well put it this way my PhotoPost gallery has not been affected by this at all and it still functions as it always has, so they are using a different way approach to this. My Xenforo forum has no issu at all as they also use a different approach. It would seem that this forum VB5 also is not affected by this so this tells me it is possible to be fixed but you guys choose not to do it. So is this because this may be one way to force us forum owners to move to VB5, this would not surprise me at all. As far as making out a ticket there is no point as Mark has outlined the issue as it is. I have also had a very capable coder that has looked at it for me already and the way I have my forum setup is the only way it can be done now.

So now the way forward for me is to spend big buck one way or the other to get it sorted out but once again I ask myself am I just thoroughgoing away good money trying to patch what you guys will not. When and what will be the next issue that will be given the same approach by vBullitin and how long do I put good money into VB just to keep it going until it reaches a crash status?

This situation is just outright disgusting they way you just expect paying customers to just roll over and accept this as there is no excuse at all for this.

[Mark.B]

Well put it this way my PhotoPost gallery has not been affected by this at all and it still functions as it always has, so they are using a different way approach to this. My Xenforo forum has no issu at all as they also use a different approach. It would seem that this forum VB5 also is not affected by this so this tells me it is possible to be fixed but you guys choose not to do it. So is this because this may be one way to force us forum owners to move to VB5, this would not surprise me at all. As far as making out a ticket there is no point as Mark has outlined the issue as it is. I have also had a very capable coder that has looked at it for me already and the way I have my forum setup is the only way it can be done now.

So now the way forward for me is to spend big buck one way or the other to get it sorted out but once again I ask myself am I just thoroughgoing away good money trying to patch what you guys will not. When and what will be the next issue that will be given the same approach by vBullitin and how long do I put good money into VB just to keep it going until it reaches a crash status?

This situation is just outright disgusting they way you just expect paying customers to just roll over and accept this as there is no excuse at all for this.

I am sorry. The uploader code, and anything else that uses YUI2, would require a substantial rewrite to get round this, and at the moment there are no plans to tackle that level of work.

If however anyone is finding that they are no longer getting the full asset manager, and are instead back on the "legacy" file uploader, than to be clear that should NOT be the case and we will help resolve that.

And to be clear: this has nothing whatsoever to do with forcing people onto vB5. vB5 uses an entirely different system for uploading which was substantially rewritten from anything vB4 uses. Which brings me back to what I said at the top of this post.

[Kaith Rustaz]

I seem to only be able to select and upload 1 image at a time. I'm starting to get complaints from members as a result of this. Asset Manager - Enable - Yes, Ajax
Advanced Insert Image Popup - Enable - Yes

[Zachery]

That is the insert image prompt, not the asset manager, which is the only thing that changed. They need to click the paper clip icon, or the manage attachment button below the editor.

[Kaith Rustaz]

I seem to be missing the paper clip icon. in the Quick Reply box.

It seems the "solution" here is to retrain my members to not click the intuitive "insert image" icon, but point them at "asset manager", which seems to require they always click "go advanced", then click "assets", then select files 1 at a time to upload. I'm fighting to keep members who are migrating to Facebook. Combine this with ongoing problems with the obsolete editor, increasing browser incompatibilities, and other it's becoming a concern. I've been a loyal vB customer since 2001, manage several communities (all vB), and want to continue.

It seems to me the fix for this problem is simple. vB doesn't have an on-staff Flash coder. You're owned by one of the if not the largest community portfolio companies. Send someone over to vB.org, see who might have written an improved uploader or something, offer them a grand or 2 to chug some Red Bull and crank out an uploader that'll knock the socks off everyone elses, and push it out on Monday. Or put that effort into getting the current version of ckeditor out to us vB4 folks, and include this: http://www.ckuploader.com/

btw, any reason why the comment box here is only showing 1 line at a time with no apparent option to resize?

[DirtRider]

Well I am now out of this as I just purchased Xenforo and am organizing to start the process of my conversion. I cannot work with this careless attitude towards customers any longer. It has only been a few days and already my members are complaining bitterly over this issue.

So there you go VB another customer lost to bad customer support

[Zachery]

I am finding this situation absolutely shocking that a function that is a core part of a forum gets taken away like this and we just get told bad luck you having we not going to fix it. So the alternative now is to spend big money on either moving to Xenforo what I would like to do. However with all my paid VB mod I would now need to be converted to Xenforo. I can also commission a coder to write a workaround for me for VB but my problem is what next will we just find that now does not work any more on VB

Shame on you all

I did a lot of reading on VB5 reviews today and all I can find are site after site telling us how bad it is but I suppose I already knew that

The core function of the software, is being able to upload things at least in this case. The bonus functionality is the multi select. Lets at least be honest about what we’re talking about here. None of us are thrilled about the loss of the functionality. But we have a choice, we can either fix the vulnerability, or not. That was our choice here. Wayne mentioned we don’t have a flash programmer, and we never have. Which would make patching the actual swf uploader not a trivial thing. Further, the flash people working on YUI 2/3, given the history of security issues with the swf files, decided that they didn’t want to keep fixing it, because it wasn’t worth it.

Lets say we have the time and resources to add the replacement into the vB4 software, do you believe it would have happened in a fairly quick time table? There isn’t anyting we can drop in to replace the swf uploader, and have it work. vBulletin 5 uses a nice jquery lib, but we don’t have nearly any jquery code in vB4, the entire software is more or less built on yui. We might be able to use it, but not to just patch up the YUI asset manager, so we’d have to rebuild something from scratch to replace the asset manager. Do you see the rabbit hole? This is something that would compete with updating the ckeditor. In both dev and QA stuff.

It bothers me that you say we’re bad at “support”. Our job as support is to help customers work though problems using the software, not to fix it. I don’t see how the support people here are failing to do their jobs. They are here giving you honest answers, they’re in the same boat as you. They use the vBulletin software to power their sites too.

Anyway, as you’ve mentioned in another post, you’re moving on. I’m sad to hear that, but I hope your conversion goes smoothly, and that it works out well for your community and yourself. Best of luck.

[bar10dr]

It bothers me that you say we’re bad at “support”. Our job as support is to help customers work though problems using the software, not to fix it. I don’t see how the support people here are failing to do their jobs. They are here giving you honest answers, they’re in the same boat as you. They use the vBulletin software to power their sites too.

It bothers me that the company you work for sold us a product that loses functionality with time, and when that functionality breaks you do not put any resources towards fixing it so that we can get the same set of functionality we paid for.

You have a third choice you didn't mention, which is to opt for another upload system with the same functionality, integrate it in the forum and provide it as a free update as a service to your customer base instead of trying to force them to upgrade in order to get the functionality back.
I understand you need income in order to survive just as any other business, but at the same time please understand that when you do not provide for your already existing customer base, it doesn't make us _want_ to upgrade because we now know that if this happens in the future you won't give a **** as long as you have something newer to sell.

It shows us that what you as a company think about your customers and its a great way to lose business in the long term.

As support crew you are our point of contact, so you will get the flak for what we think about your firms actions. Please do not take it personal as it is not meant to be personal.

-Nico

[naveedfarooq]

first of all , i would like to say that the behavior and response of vbulletin official team and as a company is hopeless , and i fully agree with this view that the company is not interested to solve our issues because they want us to move on vbulletin 5 forcefully , we are sorry , we are really not interested because of our past experiences.

secondly i want to mention that a member named alexm has generated a modification to solve out this issue , he has patched the flash file and released it in modifications , but again i felt bad that the company officials dont bother to direct us towards that modification , dont bother , because its not their concern , we have paid the license fee and thats all , now consider us dead... :P

here is the url of the patched version of the flash uploader file , i just installed it 5 minutes ago , its working very fine as original and no issue.

http://www.vbulletin.org/forum/showthread.php?p=2482276