SimplePortal
Development => Feature Requests => Topic started by: aegersz on October 13, 2018, 01:46:58 PM
-
Hi, I i like to use the html BBCode facilty in Shoutbox but I noticed that it doesn't turn off for non-Admins despite disabling it in SMF.
This is a potentially dangerous situation as anybody could introduce malicious javascript so i would like SP to honor the SMF setting and strip off the <html></html> markup.
is that too big a task ?
I guess it could be a mod and maybe i can write it too ... just floating the idea to see if you agree with me.
It may also be an option for the SP - Extra Shoutbox Permissions/Options mod but the selection but SMF already supports this flag selection via Admin > Post and Topics > Bulletin Board Code > Enable basic HTML in posts checkbox
-
I guess it's an oversight but you can probably fix it with this: https://simpleportal.net/index.php?topic=11714.0
-
i have version 1.70 of that mod and i can't see it in Permissions or the SP Config.
where can i find it and I politely ask why didn't you interrogate and conform to SMF's settings (as it is more logical to do so) ?
no matter ... i must be missing something or is this unique to Version 1.71 ?
thanks again, sorry to bother.
-
Should be the regex filter itself, and filter <html> tags by stripping the <>. Haven't used it in ages so I'd have to test it :P
As for
where can i find it and I politely ask why didn't you interrogate and conform to SMF's settings (as it is more logical to do so) ?
Like I said probably an oversight... But I'm not a dev so there's that ;D
-
of course, you did mention that. tbh, regex filters look daunting but i am about to deploy one that i found - it strips the HTML from a URL link and just leaves the link's string but doesn't accommodate spaces in the file name yet.
a work in progress.
i will try that filter or adapt it and delve deeper into Regular Expressions.
stay tuned :P
-
simple when you find the cheat sheets :)
1. Exempt Admins [ticked]
2. Regex Filter is (array('#<html>#m','#</html>#m'),array(' ',' ')
thanks for your help, Ninja !
EDIT: added 'm' (for multiple) as I originally omitted from the <html> start tag accidentally.
-
There you go! Glad it worked then :D
We'll definitely need to fix that permission thing in a future release anyway, don't think it's intended.
-
There are settings within each shoutbox to enable/disable specific bbcodes.
You can simply disable the html bbcode that you are talking about by ensuring it is not highlighted from that list.
Unless you want admins to use it in the shoutbox but no one else.
You can try this:
regex filter:
<html[^>]+?[^>]+>|</html>
regex callback:
preg_replace('/<html[^>]+?[^>]+>|</html>/i','',$m[0])
-
thank you and yes, i am aware and use the 'enable/disable specific bbcodes' menu option.
I decided to keep my regex filter and use your regex callback (but had no idea what that was and despite reading up on, still have no clue but i'm certainly going to use yours).
I want my Shoutbox to support all/most bbcodes but haven't added any icons for them as I want keep them hidden.
-
The filter is the regex condition to trigger the callback function.
The callback function is to change the shout text.. with that example I used preg_replace.
$m is the array containing the data for the callback..
in this case $m[0] is the entire shout line that was entered by the member.