Simple Machines Community Forum

SMF Support => SMF 2.0.x Support => Aiheen aloitti: dakpluto - maaliskuu 01, 2009, 11:56:42 AP

Otsikko: bbcode script problem RC1
Kirjoitti: dakpluto - maaliskuu 01, 2009, 11:56:42 AP
I added this code to my subs.php file:

array(
'tag' => 'ffxiah',
'type' => 'unparsed_content',
'content' => '<script type="text/javascript" src="http://www.ffxiah.com/widget.php?q=equip&server=cerberus&name=$1"></script>',
'validate' => create_function('&$tag, &$data, $disabled', '$data = strtr($data, array(\'<br />\' => \'\'));'),
'disabled_content' => '($1)',
),
array(
'tag' => 'ffxiahprofile',
'type' => 'unparsed_content',
'content' => '<script type="text/javascript" src="http://www.ffxiah.com/widget.php?q=profile&server=cerberus&name=$1"></script>',
'validate' => create_function('&$tag, &$data, $disabled', '$data = strtr($data, array(\'<br />\' => \'\'));'),
'disabled_content' => '($1)',
),


The javascript loads perfectly fine.  I see the box correctly, and appears correctly in my signature.  The problem is, now whenever I make a new post, the screen goes white just showing the box and I have to hit back to bring the forums up again and see my post.  Any idea why this is happening?

EDIT: btw, if I do a modify post, it doesn't happen.  Only affects brand new posts.
EDIT 2: Only seems to be affected when using quick reply.
EDIT 3: OK, only seems to be a conflict with AJAX Advanced Quick Reply mod, I'll move my question there, sorry.



Otsikko: Re: bbcode script problem RC1
Kirjoitti: karlbenson - maaliskuu 01, 2009, 01:39:48 IP
Note to prevent possible xss exploits, you should validate the data before allowing it to be included in the script ($1).