1 Topic by HMEternity (edited by HMEternity 2005-05-05 20:38)

  • Registered: 2004-06-05
  • Posts: 27

Topic: Forum won't convert [img] tag unless you include http://

My forum won't convert the tags and url's into an image unless you include the http:// part. Is there a reason it shouldn't or is this a bug?

It's easy enough to get around, but I thought I'd alert you.

Here's an example:

[img]www.hmeternity.net/Forum/img/other/e2.gif[/img]

2 Reply by Dexus

  • Dexus
  • Senior Member
  • Offline
  • Registered: 2005-03-30
  • Posts: 154

Re: Forum won't convert [img] tag unless you include http://

it's not a bug. it's a feature. lok into parser.php line 462
$text = preg_replace('#\[img\]((ht|f)tps?://)([^\s<"]*?)\[/img\]#e', 'handle_img_tag(\'$1$3\', true)', $text);
you see there (http/https/ftp/ftps://) as must-be prefix. you could replace it with
$text = preg_replace('#\[img\]([^\s<"]*?)\[/img\]#e', 'handle_img_tag(\'$1\', true)', $text);
but in fact it will make forum more vulnerable.

  • From: 127.0.0.1
  • Registered: 2001-11-02
  • Posts: 9,167

Re: Forum won't convert [img] tag unless you include http://

Potential cross site scripting vulnerabilities is exactly what I'm afraid of. If possible, I don't want to "open up" the image tag any more than it is today.

"Programming is like sex: one mistake and you have to support it for the rest of your life."

Rickard's Website