Try to prevent (as much as possible) transfering and, more important, storing, any other files than avatars as png, gif and jpg. The headers of the files are checked whether they are valid for the corresponding format. Files without gif/png/jpg header are never stored on the server, and thus cannot be requested by any client.

src/core/avatarmanager.h

@@ -29,6 +29,7 @@
 #include <boost/thread.hpp>
 #include <boost/shared_ptr.hpp>
 
+#define MIN_AVATAR_FILE_SIZE	32
 #define MAX_AVATAR_FILE_SIZE	30720
 
 struct AvatarFileState;
@@ -52,6 +53,8 @@ public:
 	bool HasAvatar(const MD5Buf &md5buf) const;
 	bool StoreAvatarInCache(const MD5Buf &md5buf, AvatarFileType avatarFileType, const unsigned char *data, unsigned size);
 
+	static bool IsValidAvatarFileType(AvatarFileType avatarFileType, const unsigned char *fileHeader, unsigned fileHeaderSize);
+
 protected:
 	typedef std::map<MD5Buf, std::string> AvatarMap;