cclaerhout
Well-known member
Always the same problem: see here.could you explain this?*g* what's the deal with the closing
Always the same problem: see here.could you explain this?*g* what's the deal with the closing
Add another bbcode named [tdcolspan] with one required option.
Start replace: <td colspan="{1}">
End replace: </td>
Usage: [tdcolspan=2]Test[/tdcolspan]
Thanks Moz, but it doesn't seem to be working for me for some reason.
If you have a moment, here's the bbcode that I'm using: http://xenforo.com/community/threads/bb-code-manager-bb-code-xml-repository.8470/page-2#post-154291
Would it have something to do with how thebbcode is setup?
I kinda forgot about this post... but, your method of escaping isn't secure, things like this still work:You can't forbid someone to use a tag, but you can use a different display per user as describe above.
Thanks for that report !
Find this code in library/KingK/BbCodeManager/BbCode/Formatter/default.php:
And replace with that:Code:<input id="spoiler_' . $tagId . '" class="button" type="button" value="' . $buttonText . '" onclick="]
It seems to be safe after this.Code:<input id="spoiler_' . $tagId . '" class="button" type="button" value="' . htmlspecialchars($buttonText) . '" onclick="
I'm going to check my bbcodes after this ^^
[spoiler=asdf" onmouseover=alert(document.cookie) "asdf]Stuff[/spoiler]
I kinda forgot about this post... but, your method of escaping isn't secure, things like this still work:
Code:[spoiler=asdf" onmouseover=alert(document.cookie) "asdf]Stuff[/spoiler]
This is because escaping with slashes doesn't work within a single quote. (That's also not the right way to escape for web.)
To solve, swap htmlspecialchars and addslashes for addslashes(htmlentities($textHere, ENT_QUOTES))
This will escape all characters with any significance in HTML, eg. < will become <, and addslashes will then escape the backslash to prevent it from breaking the HTML.
I'm also looking for help here--unfortunately I'm not familiar with PHP Callbacks.I'm trying to create bbcode to use html anchors in a page. The problem is when creating the link to the ancor, the bbcode is like this:
Code:[GOTO=anchorname]link text[/GOTO]
and is replaced this way:
Code:<a href="#%s">link text</a>
It works because in the post the html code result is:
The problem is that xenforo parses the url and when you click redirects you to this url: http://xenforourl/#anchorname
I had this working in vb and it's very annoying because we have several articles that use this bbcode.
I don't know how to do it wither, can anyone point us in the right direction?I'm also looking for help here--unfortunately I'm not familiar with PHP Callbacks.![]()
We use essential cookies to make this site work, and optional cookies to enhance your experience.