"Invalid image file format" Error in Movable Type

| 2 Comments | No TrackBacks |
I recently encountered a bug in Movable Type where uploading a certain image failed with the message "Saving (filename) failed: Invalid image file format". Some digging led me to the file lib/MT/Image.pm where the uploaded image was failing a check.  This was in MT4, but some older versions of MT5 can also have this happening.  So, what is going on?
The check was added recently to protect against a vulnerability where HTML files disguised as images would be uploaded by hackers (this is dangerous because the hackers can then put all kinds of nasty scripts in your website to steal cookies etc.).  The check looked for HTML tags in the first 1024 bytes of the uploaded file, and sure enough, the particular image I was trying to upload had the sequence <a in it (which was perfectly valid and OK for an image file like a .gif, .jpg or .jpeg).

Some further digging revealed that this bug had already been addressed by Six Apart in MT5.13, but it is still present in older versions and in MT4.

If this bug is causing you trouble, either update to the latest version of MT5.x, or edit following lines in lib/MT/Image.pm

90 
-        ( $data =~ m/<(HTML|SCRIPT|TITLE|BODY|HEAD|PLAINTEXT|TABLE|IMG|PRE|A)/i ) ||
 90
+        ( $data =~ m/<(HTML|SCRIPT|TITLE|BODY|HEAD|PLAINTEXT|TABLE|IMG |PRE|A )/i ) ||
9191
         ( $data =~ m/text\/html/i ) ||
92 
-        ( $data =~ m/^\s*<(FRAMESET|IFRAME|LINK|BASE|STYLE|DIV|P|FONT|APPLET)/i ) ||
93 
-        ( $data =~ m/^\s*<(APPLET|META|CENTER|FORM|ISINDEX|H[123456]|B|BR)/i )
 92
+        ( $data =~ m/^\s*<(FRAMESET|IFRAME|LINK|BASE|STYLE|DIV|FONT|APPLET)/i ) ||
 93
+        ( $data =~ m/^\s*<(APPLET|META|CENTER|FORM|ISINDEX|H[123456]|BR)/i )


No TrackBacks

TrackBack URL: http://www.movabletips.com/cgi-bin/mt/mt-tb.cgi/2586

2 Comments

I didn't see these exact strings in the Image.pm of my Movable Type Pro version 4.38. I'm wary of editing those files so I left them alone and generated a new image that didn't give me the error. For some reason I get this error if I generate PNG-24 files from Photoshop and try to upload them.

I hope SixApart will add this fix into future updates of my package.

You're so interesting! I do not believe I have read through something like that before. So great to discover somebody with a few original thoughts on this subject. Really.. thanks for starting this up. This site is one thing that is required on the web, someone with a bit of originality!

Leave a comment