Simple Machines Community Forum

SMF Development => Bug Reports => Topic started by: FredT on May 12, 2022, 08:27:29 AM

Title: HTML Tags are not allowed
Post by: FredT on May 12, 2022, 08:27:29 AM
I do have newest smf Board installed. v2.1.2

As language I do have English and German

I go to my User Profile
I go to Profile Details
As Location I use some German cities such as:
München, Würzburg

and the ü/ Ü I think throws errors, because when I use ue it works:

Error, no matter I have German or English language active:
-----------------------------------
The following errors occurred when trying to save your profile:

HTML tags are not allowed.
--------------------------------------

I also have "Enable basic html in posts" enabled. But need that in Profile and not Board. But I am not sure this change something.

Title: Re: HTML Tags are not allowed
Post by: FredT on May 18, 2022, 02:54:15 AM
Any news on this bug? I just checked and I do have the same problem in v2.1.1
Title: Re: HTML Tags are not allowed
Post by: Kira_ on May 18, 2022, 05:16:12 AM
Try to play around with these settings for a specific field.
.../index.php?action=admin;area=featuresettings;sa=profile and choose the problem field.

2.jpg
Title: Re: HTML Tags are not allowed
Post by: Arantor on May 18, 2022, 05:26:12 AM
Same problem as https://www.simplemachines.org/community/index.php?topic=582315.0
Title: Re: HTML Tags are not allowed
Post by: FredT on May 19, 2022, 03:42:52 AM
I followed Kira´s advice to check on the Input Mask. I think this could be the problem with the regular expressions.

But I am not sure chaning any of the settings will help.
We do have: No HTML, valid email, numeric, RegEx

I think Posix Brackets needs the diacritics.

Latin letters would be [a-zA-Z]
German has some more such as [a-zA-ZäöüÄÖÜß]

ß could be ignored because of the new spelling form in German we could use ss for the "sharp S".
But important are the ä,ö,ü / Ä,Ö,Ü

Not sure where to put [a-zA-ZäöüÄÖÜß or
pattern='^.*(?=.{8,})(?=.*[a-zA-ZäöüÄÖÜß])(?=.*\d).*$'
or is it
pattern='^.*(?=.{8,})(?=.*[a-zA-Z\\u0080-\\uFFFF])(?=.*\d).*$'

Title: Re: HTML Tags are not allowed
Post by: Arantor on May 19, 2022, 03:59:02 AM
This is a bug in the HTML setting, nothing more.

In the interim, that looks like a complicated regex, what exactly does this field need to hold?
Title: Re: HTML Tags are not allowed
Post by: FredT on May 19, 2022, 08:04:05 AM
Hi Arantor,

the field not working properly is the "location" field in the profile.
It can not hold City names such as München, Würzburg, or Nürnberg.

Like state it only has to hold alphabetic letters a-zA-ZäöüÄÖÜß
Title: Re: HTML Tags are not allowed
Post by: Arantor on May 19, 2022, 08:10:03 AM
What about spaces or other punctuation?
Title: Re: HTML Tags are not allowed
Post by: FredT on May 25, 2022, 05:47:00 AM
German city/location names could also have spaces, or other punctations such as:

Bad Wörishofen
Bad Tölz
Aicha vorm Wald

Ahlefeld-Bistensee
Altdorf (Kreis Esslingen)
Lahr/Schwarzwald

Title: Re: HTML Tags are not allowed
Post by: Kindred on May 25, 2022, 07:23:36 AM
Why even bother with the input mask?

Seriously,  it sounds like you're trying to force a technical solution into a section which probably doesn't actually needs it
Title: Re: HTML Tags are not allowed
Post by: Arantor on May 25, 2022, 03:02:33 PM
No, he's really not. He's trying to work around a bug in SMF where using the 'no HTML' filter doesn't let anything with accents in because it sees the & in the entity encoding and assumes it's invalid owing to a change made late in 2.1's development.

I was trying to figure out a better regex that would cover the situation in the meantime.
Title: Re: HTML Tags are not allowed
Post by: Kindred on May 25, 2022, 04:34:04 PM
OH, I know that there is a bug in the system there...

My point was that, in this specific case, is it even actually needed
Title: Re: HTML Tags are not allowed
Post by: Arantor on May 25, 2022, 04:35:51 PM
What input sanitisation would you suggest instead with the custom fields setup out of the box when the one that *should* be used doesn't work properly?

Remember: the point of the exercise is to allow members to safely add the name of a location or city in Germany which means accented letters being properly supported is a requirement.
Title: Re: HTML Tags are not allowed
Post by: Kindred on May 25, 2022, 04:37:38 PM
what if there was no mask at all is my point...   the entry won't fail if the user uses an accented character in an "open" field -- does it?
Title: Re: HTML Tags are not allowed
Post by: Arantor on May 25, 2022, 05:13:43 PM
The choices in the dropdown are "No HTML", "Email", "Numeric" and "Regex (Advanced)". There is no option for what you're suggesting, and the correct option doesn't work.

So we're trying to work out a suitable option that DOES work in the meantime.

But even if 'no mask' were an option, do you *really* want to put in a field that has the risk to hijack someone's account?
Title: Re: HTML Tags are not allowed
Post by: Kindred on May 25, 2022, 05:26:02 PM
Ok, fair... I was wrong.

Carry on