[Plugin: Connections] TimThumb error has occured

@shazahm1

It’s not that simple. My server host required me to remove the script because of the following detected by the TimThumb Vulnerability Scanner:

Error 1:

Vulnerable 0 connections.php

/wordpress/wp-content/plugins/connections/connections.php

Error 2:

Outdated 2.8.10 timthumb.php

/wordpress/wp-content/plugins/connections/includes/timthumb/timthumb.php

When I ran the TimThumb Vulnerability Scanner Fix, Connections causes WP to crash.

Are you saying this can safely be ignored?

@brancht

Yes, it safe to ignore because it’s not completely accurate.

Error 1:

connections.php is not timthumb so it is being incorrectly identified. My guess is because the name of the timthumb exists as a comment in the code giving credit to the code author. So TimThumb Vulnerability Scanner incorrectly overwrites the connections.php file, which is bad. It not Connections causing WP to crash it is TimThumb Vulnerability Scanner Fix overwriting an incorrect file which in turn is causing WP to crash.

Error 2:

Is correct. The latest version is 2.8.11 which released on Dec 4th 2012. No, security related changes where made between 2.8.10 and 2.8.11. It was just a minor change in PNG transparency handling. The next version of Connections will include the latest.

In short, yes, ignore, safely. Hope that helps.

@shazahm1

I edited connections.php to remove the comment relating to TimThumb–that makes the TimThumb Scanner happy. You may want to find a way around that in a future release.

Will Connections run using the most current TimThumb (Version 2.8.11)? If so I may upgrade it.

Thanks.

Tom

@brancht

Yes, you can safe upgrade TimThumb yourself. Grab the code here:
https://code.google.com/p/timthumb/

Where is says grab the code, right click and do a save as.

You can then overwrite the version here:
../wp-content/plugins/connections/includes/timthumb/timthumb.php

Just don’t delete the timthumb-config.php file.

@shazahm1

Thanks.

Tom

hello experts,

After i switched my wordpress 3.51 to “https” all thumbnails seems broken. My wordpress use a theme that has its own “TimThumb”

https://let.de/index.php/blog/ < right site when i click on the image i got this error”

A TimThumb error has occured

The following error(s) occured:
Could not find the internal image you specified.

Query String : src=//let.de/wp-content/uploads/2012/03/acessgrid.jpg&w=60&h=60&zc=1&q=100
TimThumb version : 2.8.11

“https://let.de/wp-content/themes/u-design/scripts/timthumb.php?src=//let.de/wp-content/uploads/2012/03/acessgrid.jpg&w=60&h=60&zc=1&q=100&#8221;

I upgraded to the latest Version of “TimThumb”

Thanks

chmod timthumb folder to 777

in my case
wp-content/themes/mio/sp-framework/timthumb

Thats it.

Having the same issue, WP 3.5.1, new install of Connections Pro and Tile Plus template:

· The image being referenced comes up fine on its’ own.
_____________________________________________________

A TimThumb error has occured

The following error(s) occured:
Could not find the internal image you specified.

Query String : src=https://sawdustartfestivaltemp.com.previewdns.com/wp-content/connection_images/linda_ames_bracelet_2001_original.jpg&h=130&w=100&zc=2
TimThumb version : 2.8.11

Also, I made sure timthumb folder and its’ content are set to 777. Still same error above.

Try this:
https://stackoverflow.com/questions/11048349/timthumb-could-not-find-the-internal-image-you-specified

Okay based on that, I checked the value of $src being used at line 849 of timthumb.php. It looks like godaddy’s previewdns feature is being mauled by timthumb:

$src has a value of “.previewdns.com/wp-content/connection_images/linda_ames_bracelet_2001_original.jpg”

instead it should be “https://sawdustartfestivaltemp.com.previewdns.com/wp-content/connection_images/linda_ames_bracelet_2001_original.jpg&#8221;

HOWEVER, when I force it to add the missing part of the src it still gets the same error:

protected function getLocalImagePath($src){
// added this line:
$src = “https://sawdustartfestivaltemp.com&#8221;.$src;

Maybe the solution is simpler. Likely the issue will resolve itself when you push the site to be live.

Likely may not be good enough, this is a high visibility site that can’t go live if it might be broken! Is there any kind of hack I can do to make this work?

@ ocwebmonkey

Ok, plan B then.

Use this shortcode:
[connections image_width='' image_height='']

Change the Medium Image size under the Image settings tab on the Connections : Settings admin page to 80px width and 120px height.

Any images that you have previously uploaded, reupload so the new image settings will be applied.

This will force the template to use the cached image rather than trying to create it dynamically.

That’s actually a really good hack! However, I was able to get the customer to let me drop it onto a different domain name they own, and the problem was resolved. I’m definitely bookmarking your fix in case I need it in the future! Thanks for your help.