diff --git a/phpBB/includes/usercp_avatar.php b/phpBB/includes/usercp_avatar.php index 20034c643d..5429856a44 100644 --- a/phpBB/includes/usercp_avatar.php +++ b/phpBB/includes/usercp_avatar.php @@ -100,6 +100,8 @@ function user_avatar_url($mode, &$error, &$error_msg, $avatar_filename) $avatar_filename = 'http://' . $avatar_filename; } + $avatar_filename = substr($avatar_filename, 0, 100); + if ( !preg_match("#^((ht|f)tp://)([^ \?&=\#\"\n\r\t<]*?(\.(jpg|jpeg|gif|png))$)#is", $avatar_filename) ) { $error = true;