Inserting A Photo Test

Like this?

https://flic.kr/p/4ti4h

Click on the rightward pointing arrow that says “Share Photo” (look for it at the lower right corner), then copy the link that pops up. Paste the bare URL into the SDMB reply box.

I just created this for a private message, but it’s too good for just PM’s…

Imgur

Definitely too good for just a PM.

The Doper Squad?

Okay, this is the last thing I’ll say on the matter.

I know someone walked me through in the past. And I was able to do it then :slightly_smiling_face: .

Tell me in explicit detail how to do it. Leave out no detail, no matter how small. :slightly_smiling_face:

Also, I should point out, I usually use a smartphone. It seems to work differently on that, for some reason.

Thank you in advance :slightly_smiling_face: .

Do the same thing you did in the OP BUT USE A SUPPORTED IMAGE TYPE like JPG.

Using Flickr on my phone. Assuming you know how to upload a photo in Flickr AND view it.

Imgur

Imgur

Imgur

And do not use underscores – Discourse hates them in urls.

As stated in the linked thread, use %5F instead of underscores.

SVGs can contain significant security exploits, so it’s better to use the jpg/png where you can.

Isn’t that something the software is supposed to mitigate?

From W3C

SVG as image

Markup languages like HTML (and SVG itself) can reference SVG as an image with the <img> tag (HTML namespace) or <image> tag (HTML or SVG namespace).

If an SVG file is fetched as image, then certain requirements apply to this document:

  • The SVG document is not allowed to fetch any resources. This also applies to scripts, stylesheets or images.
  • Fonts shouldn’t be loaded as well. The situation in UAs seems to still be unclear though.
  • Scripts must not be executed.
  • The style attribute and the style element can style the document. Restricting these is unpractical. A lot of content already relies on CSS styling and would be broken by changing any default setting. Even though SVG has presentation attributes, these are still implemented as a stylesheet with slightly higher hierarchy than UA styles. UA styles must be applied in certain cases as well.
  • SVG Animations and CSS animations are still allowed. This also allows conditions where animation wait for other animations to be finished.
  • Hit testing must be disabled at all times.
  • Event listeners must be disabled at all times.

~Max

Yes, you can allowlist the safe elements, but it’s better to avoid the whole SVG scene in risky user generated content if you can – especially since SVGs rarely survive being handed off to email and email clients.

Vector images are nice for infinite scaling, but in practice an optimized PNG usually works at the common range of resolutions you’d expect … some illustration style images would be smaller as a SVG but are compact enough as PNGs.

It’s the great shame of us software engineers. When the question is should my new image format be Turing-complete?, the answer is no. And yet here we are…

I meant the browser is supposed to play safe with SVGs in image elements.

If you want to reject SVG uploads, that’s one thing. But we’re talking about oneboxes here.

~Max

Actually, I’m reading that some major SVG vulnerabilities are marked as wontfix in Chrome, or are still open in Firefox. Thus I retract my position and perhaps suggest that Discourse add a warning when creating/following a direct hyperlink to SVG documents, so the average user has some hint as to why it’s not working as expected.

~Max