Example. An admin that start the post with
[HTMLMARKUP]
will have the post content parsed as html. The placeholder can also be changed, but it is not about security, read inline code comments:
Code: Select all
// © axew3.com
public function viewtopic_modify_post_data($e)
{
$e_rowset = $e['rowset'];
foreach($e_rowset as $p => $pp){
// only if the case we execute this
if ( substr($pp['post_text'], 0, 15) == '<t>[HTMLMARKUP]' ) // ** can be changed to a custom word
{
$sql = "SELECT group_id FROM " . USERS_TABLE . " WHERE user_id = ".$pp['user_id']."";
$res = $this->db->sql_query($sql);
$row = $this->db->sql_fetchrow($res);
$this->db->sql_freeresult($res);
if( $row['group_id'] == 5 ) // only the default user's group considered here, admin in this case
{
$parse_flags = ($pp['bbcode_bitfield'] ? OPTION_FLAG_BBCODE : 0) | OPTION_FLAG_SMILIES;
// ** the HTMLMARKUP placeholder can be changed into something custom, so that only users that know the magic word can add HTML CODE that will be parsed,
// this just avoid that nobody can joke with the thing slowing down the foreach, adding the magic word, even if for him it will never be parsed (it will be anyway secure)...
$e_rowset[$p]['post_text'] = str_replace("[HTMLMARKUP]", "", $pp['post_text'], $count); // $count not used, but could for more complex things
// !! if the post_text will contain also one single bbcode, the following line will NOT let parse as html the subsequent html_entity_decode()
// $e_rowset[$p]['post_text'] = generate_text_for_display($e_rowset[$p]['post_text'], $pp['bbcode_uid'], $pp['bbcode_bitfield'], $parse_flags, true);
$e_rowset[$p]['post_text'] = html_entity_decode($e_rowset[$p]['post_text']);
}
}
}
$e['rowset'] = $e_rowset;
unset($e_rowset);
}
i will install here at axew3.com as ready, with the challenge: 300$ to who is capable to show how it could be exploited
Do not waste your time, it is impossible.
This is stupid code. For this cannot be exploited. It KISS
p.s something into the flow need to changed to not waste resources, i will fix this night
It is just a test snippet.
$e_rowset = $e['rowset']; assignment need to be done only when it is required because a topic post contain the magic word, and not ever.
Stay tuned, it will be cool
