<![CDATA[PunBB Forums — [RELEASE] bbcode_html (Allow html in post, reply, pm)]]> https://punbb.informer.com/forums/topic/25360/release-bbcodehtml-allow-html-in-post-reply-pm/ Sat, 23 Apr 2016 20:18:01 +0000 PunBB <![CDATA[Re: [RELEASE] bbcode_html (Allow html in post, reply, pm)]]> https://punbb.informer.com/forums/post/155829/#p155829 I think it would be better to resolve any tags, but only for the administrator .

See how it's done [url=https://[[punbb.info]]/repository/1_4/extensions/pan_html_in_posts/pan_html_in_posts.zip]here[/url]

There for HTML and script a separate field .

]]> Sat, 23 Apr 2016 20:18:01 +0000 https://punbb.informer.com/forums/post/155829/#p155829 <![CDATA[Re: [RELEASE] bbcode_html (Allow html in post, reply, pm)]]> https://punbb.informer.com/forums/post/155828/#p155828 I've seen it is possible to put flash games into posts (a .swf works inside the post) with that extension, maybe it's not risky.
But i've made a bug of the forum trying the possibily of a javascript code, this sounds risky...
Just with that script inside a post (which is not risky script, just an effect on letters but it closed the topic, nobody could answer, and also closed the possibility of editing or deleting the post, so what about a risky javascript ?) :

<h2>
<script language="JavaScript1.2">

/*
Neon Lights Text
*/

var message="Welcome to JavaScript Kit!"
var neonbasecolor="gray"
var neontextcolor="yellow"
var flashspeed=100  //in milliseconds

///No need to edit below this line/////

var n=0
if (document.all||document.getElementById){
document.write('')
for (m=0;m<message.length;m++)
document.write('<span id="neonlight'+m+'">'+message.charAt(m)+'</span>')
document.write('')
}
else
document.write(message)

function crossref(number){
var crossobj=document.all? eval("document.all.neonlight"+number) : document.getElementById("neonlight"+number)
return crossobj
}

function neon(){

//Change all letters to base color
if (n==0){
for (m=0;m<message.length;m++)
//eval("document.all.neonlight"+m).style.color=neonbasecolor
crossref(m).style.color=neonbasecolor
}

//cycle through and change individual letters to neon color
crossref(n).style.color=neontextcolor

if (n<message.length-1)
n++
else{
n=0
clearInterval(flashing)
setTimeout("beginneon()",1500)
return
}
}

function beginneon(){
if (document.all||document.getElementById)
flashing=setInterval("neon()",flashspeed)
}
beginneon()


</script>
</h2>

If a javascript code can cause dysfonctions of the forum, i guess it would be better not allowing javascript in the html code.
EDIT : if i put "<script>" at the beginning it doesn't try to run the script, i guess the script could run because of the  "<script language="JavaScript1.2">" at the beginning of the script, a case that wasn't expected in the extension and let the script trying to run and cause dysfonctions.

]]> Sat, 23 Apr 2016 19:29:16 +0000 https://punbb.informer.com/forums/post/155828/#p155828 <![CDATA[Re: [RELEASE] bbcode_html (Allow html in post, reply, pm)]]> https://punbb.informer.com/forums/post/155827/#p155827 Ok, maybe the script in the last version is secure enough, i don't know, what do you think ?
About security, i've seen that part in the script code :

//Removing possible attacks
          if (strpos($text, '<script>') !== false && strpos($text, '</script>') !== false )
                       {
                          $text = str_replace(array('<script>', '</script>'), ' ', $text);
                            }
                            elseif (strpos($text, '<body>') !== false && strpos($text, '</body>') !== false )
                       {
                          $text = str_replace(array('<body>', '</body>'), ' ', $text);
                            }
                            elseif (strpos($text, '<html>') !== false && strpos($text, '</html>') !== false )
                       {
                          $text = str_replace(array('<html>', '</html>'), ' ', $text);
                            }
                            elseif (strpos($text, '<head>') !== false && strpos($text, '</head>') !== false )
                       {
                          $text = str_replace(array('<head>', '</head>'), ' ', $text);
                            }
          elseif (strpos($text, '<script>') !== false)
                       {
                          $text = str_replace('<script>', ' ', $text);
                            }
          elseif (strpos($text, '</script>') !== false)
                       {
                          $text = str_replace('</script>', ' ', $text);
                            }
          elseif (strpos($text, 'text/javascript') !== false)
                       {
                          $text = str_replace('text/javascript', ' ', $text);
                            }
        elseif (strpos($text, '</head>') !== false)
                       {
                          $text = str_replace('</head>', ' ', $text);
                            }
         elseif (strpos($text, '</body>') !== false)
                       {
                          $text = str_replace('</body>', ' ', $text);
                            }
         elseif (strpos($text, '<head>') !== false)
                       {
                          $text = str_replace('<head>', ' ', $text);
                            }
         elseif (strpos($text, '<body>') !== false)
                       {
                          $text = str_replace('<body>', ' ', $text);
                            }
         elseif (strpos($text, '<html>') !== false)
                       {
                          $text = str_replace('<html>', ' ', $text);
                            }
         elseif (strpos($text, '</html>') !== false)
                       {
                          $text = str_replace('</html>', ' ', $text);
                            }

Is it safe enough like that ?

]]> Sat, 23 Apr 2016 19:06:22 +0000 https://punbb.informer.com/forums/post/155827/#p155827 <![CDATA[Re: [RELEASE] bbcode_html (Allow html in post, reply, pm)]]> https://punbb.informer.com/forums/post/155826/#p155826 Yes, but not enough to hide the button. It is not problem...

It is also necessary to check a message for the presence of the tag [html]  and [/html] in the file post.php.

]]> Sat, 23 Apr 2016 18:18:21 +0000 https://punbb.informer.com/forums/post/155826/#p155826 <![CDATA[Re: [RELEASE] bbcode_html (Allow html in post, reply, pm)]]> https://punbb.informer.com/forums/post/155825/#p155825 Yes i have tried before, it works as a user, new user or guest (if we allow guests to post).
Maybe a way to avoid news users to use htm would be to hide the html button from bbcode buttons and tell the html function only to users that you know well ? If it helps in some functions allowing html for some members.
I've seen Abir made some changes to avoid some security attacks, maybe it's secure enough now, i don't know, i guess it would be enough if new users don't see it o can't do it.

]]> Sat, 23 Apr 2016 17:39:24 +0000 https://punbb.informer.com/forums/post/155825/#p155825 <![CDATA[Re: [RELEASE] bbcode_html (Allow html in post, reply, pm)]]> https://punbb.informer.com/forums/post/155824/#p155824 You have tried to place the tags as a user?

if all the user may add [html] tag , it is necessary to check for the presence of [html] tag.

]]> Sat, 23 Apr 2016 17:25:18 +0000 https://punbb.informer.com/forums/post/155824/#p155824 <![CDATA[Re: [RELEASE] bbcode_html (Allow html in post, reply, pm)]]> https://punbb.informer.com/forums/post/155822/#p155822 Hello, i guess that allowing every new user to post html may be dangerous, would that be possible to allow only admin to post and edit html in post ?

]]> Sat, 23 Apr 2016 12:04:41 +0000 https://punbb.informer.com/forums/post/155822/#p155822 <![CDATA[Re: [RELEASE] bbcode_html (Allow html in post, reply, pm)]]> https://punbb.informer.com/forums/post/146190/#p146190 It worked thank you so much !!!!

]]> Mon, 27 Aug 2012 10:40:34 +0000 https://punbb.informer.com/forums/post/146190/#p146190 <![CDATA[Re: [RELEASE] bbcode_html (Allow html in post, reply, pm)]]> https://punbb.informer.com/forums/post/146189/#p146189 OK thank you so much for this advice !!!!!! I try this and get back.

RULE N°1 : CHECK THE EXTENSION VERSION BEFORE ACTING IN ANY WAY :'-( This little action without checking version cost me lots of problem...

]]> Mon, 27 Aug 2012 10:31:03 +0000 https://punbb.informer.com/forums/post/146189/#p146189 <![CDATA[Re: [RELEASE] bbcode_html (Allow html in post, reply, pm)]]> https://punbb.informer.com/forums/post/146188/#p146188 Eretz wrote:

OK I copied pasted define('FORUM_DISABLE_HOOKS', 1); on config.php and logically I've lost all my extensions nd my hooks, but at least my website works...

I would like to supress all the effects of this extension.

Where should I go, be it on source code files or in database, to erase all the effects of this extension ?

Then I will be able to get my extensions back, and my website back to normalty.

Can the developer of this extension tells where this extension make changes and tell how to erase it ?

1. ('FORUM_DISABLE_HOOKS', 1); on config.php
2. you deleted the extension in the wrong way before so put it back and then disable and uninstall it.
3. remove the 1.  ('FORUM_DISABLE_HOOKS', 1); on config.php
4. activate the old extensions you had before.

]]> Mon, 27 Aug 2012 09:54:35 +0000 https://punbb.informer.com/forums/post/146188/#p146188 <![CDATA[Re: [RELEASE] bbcode_html (Allow html in post, reply, pm)]]> https://punbb.informer.com/forums/post/146186/#p146186 OK I copied pasted define('FORUM_DISABLE_HOOKS', 1); on config.php and logically I've lost all my extensions nd my hooks, but at least my website works...

I would like to supress all the effects of this extension.

Where should I go, be it on source code files or in database, to erase all the effects of this extension ?

Then I will be able to get my extensions back, and my website back to normalty.

Can the developer of this extension tells where this extension make changes and tell how to erase it ?

]]> Mon, 27 Aug 2012 09:39:40 +0000 https://punbb.informer.com/forums/post/146186/#p146186 <![CDATA[Re: [RELEASE] bbcode_html (Allow html in post, reply, pm)]]> https://punbb.informer.com/forums/post/146184/#p146184 I went in the database, and I I didn't fin at all what this extension changed, be it on config table, on anycode_hook table, or on extension_hook table.

Can anyone tell me where this extension made change on my website and where I can change this so that I can erase all the changes and get back to previous situation ?

]]> Mon, 27 Aug 2012 09:02:15 +0000 https://punbb.informer.com/forums/post/146184/#p146184 <![CDATA[Re: [RELEASE] bbcode_html (Allow html in post, reply, pm)]]> https://punbb.informer.com/forums/post/146183/#p146183 I opened config.php and copy paste //define('FORUM_DISABLE_HOOKS', 1);

It changes nothing...

What I don't understand is that I re-uploaded the directory without the changes made by this extension but it changed nothing !!! Usually, when I make a mistale and reupload previous version from local folder, it get back to previous situation.

Here, it changes nothing !! What has been changed by this extension on my website ???

Oh my god it's panic here !!!

]]> Mon, 27 Aug 2012 08:43:27 +0000 https://punbb.informer.com/forums/post/146183/#p146183 <![CDATA[Re: [RELEASE] bbcode_html (Allow html in post, reply, pm)]]> https://punbb.informer.com/forums/post/146181/#p146181 I don't want to change my version, I just want to have my websoite back to it original situation !!!

I can't uninstall this extension because I can't access to the admin board. I have erased this extension (both folder and in database but it changes nothing, I still have this message !!

Oh my god.

]]> Mon, 27 Aug 2012 08:33:28 +0000 https://punbb.informer.com/forums/post/146181/#p146181 <![CDATA[Re: [RELEASE] bbcode_html (Allow html in post, reply, pm)]]> https://punbb.informer.com/forums/post/146179/#p146179 This extension has just killed my website !!!!!!!!!!!!!!

]]> Mon, 27 Aug 2012 08:31:02 +0000 https://punbb.informer.com/forums/post/146179/#p146179