I had an incident not too long ago on vBulletin where a remote embedded image was changed on the remote server to a PHP script serving malware. We're migrating to XF soon and given the massive jump in usability for embedding images in XF 1.2 vs vB4 (it really blows), I'd like to force users to post all images as attachments instead of embedding remote images where I can control PHP execution. With the drag-n-drop and copy/paste functionality there's really no excuse not to use attachments now. It appears from first glance that I may be able to do this with @cclaerhout 's BBCodes Button Manager addon but it doesn't go into great detail about what the BBCode permissions do in the description. Is that addon the best way to handle this need or am I missing some stock functionality that I can use to meet this end?