Description:
------------
Using the online editor to view figures results in a broken image or garbage.

PNGs and GIFs return a broken image.
JPGs return their binary which is attempted to be displayed as text.

Strangely enough, the response for PNGs and GIFs is "text/plain" and Google 
Chrome's console shows ...

"getImageContent:-1Resource interpreted as Image but transferred with MIME type 
text/plain."

The plain text shows ...

"{"msg":"CSRF token missing or invalid","success":false}"

which is consistent with the request as this is missing the token.

The headers I see are ...

Request URL:https://edit.php.net/do/getImageContent?
FileLang=en&FilePath=/reference/image/figures/&FileName=imageconvolution_gaussia
n.png
Request Method:GET
Status Code:200 OK


Request Headers

Accept:*/*
Accept-Charset:UTF-8,*;q=0.5
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-GB,en;q=0.8,en-US;q=0.6
Connection:keep-alive
Cookie:[SNIPPED]
Host:edit.php.net
Referer:https://edit.php.net/
User-Agent:Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.1 (KHTML, like Gecko) 
Chrome/15.0.849.0 Safari/535.1


Query String Parameters

FileLang:en
FilePath:/reference/image/figures/
FileName:imageconvolution_gaussian.png


Response Headers

Cache-Control:no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection:Keep-Alive
Content-Encoding:gzip
Content-Length:75
Content-Type:text/plain; charset=utf-8
Date:Tue, 16 Aug 2011 10:28:52 GMT
Expires:Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive:timeout=15, max=100
Pragma:no-cache
Server:Apache/2.2.12 (Ubuntu)
Vary:Accept-Encoding
X-Content-Type-Options:nosniff
X-Powered-By:PHP/5.3.6RC1


No CRSF token supplied.

Which is supplied for a JPG file request.

Request URL:https://edit.php.net/do/getFile
Request Method:POST
Status Code:200 OK


Request Headers

Accept:*/*
Accept-Charset:UTF-8,*;q=0.5
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-GB,en;q=0.8,en-US;q=0.6
Connection:keep-alive
Content-Length:223
Content-Type:application/x-www-form-urlencoded; charset=UTF-8
Cookie:[SNIPPED]
Host:edit.php.net
Origin:https://edit.php.net
Referer:https://edit.php.net/
User-Agent:Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.1 (KHTML, like Gecko) 
Chrome/15.0.849.0 Safari/535.1
X-Requested-With:XMLHttpRequest


Form Data

csrfToken:664b7d1fe2143d40121a565bf9e0f4df5f1b63fb
FilePath:en/reference/image/figures/
FileName:imagerotate.jpg
readOriginal:false
ggTranslate:false
skeleton:false
csrfToken:664b7d1fe2143d40121a565bf9e0f4df5f1b63fb


Response Headers

Cache-Control:no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection:Keep-Alive
Content-Encoding:gzip
Content-Length:9569
Content-Type:text/plain; charset=utf-8
Date:Tue, 16 Aug 2011 10:33:41 GMT
Expires:Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive:timeout=15, max=100
Pragma:no-cache
Server:Apache/2.2.12 (Ubuntu)
Vary:Accept-Encoding
X-Content-Type-Options:nosniff
X-Powered-By:PHP/5.3.6RC1