BBC HTML tag

[KillsBR]

As Admin I'm able to use the html bbc tags when posting in my forum.  The tags disappear when anybody else tries posting with them...

I want everyone to be able to use this tag...

In the admin section >> posts and topics >>  bulletin board code, all bbc codes are checkmarked...

but the tag is not appearing


http://oi54.tinypic.com/iepls9.jpg [nofollow]


http://oi56.tinypic.com/5oulwn.jpg [nofollow]

I was using version 2.0 rc4 and everyone could use .... now upgraded to 2.0 final and now can not use?!

[Illori]

no one but admin can use the bbc tag html for security reasons, it is not that hard to embed something like js that can steal a users password or other information.

[KillsBR]

but I was using version 2.0 rc4 and everyone could use .... now upgraded to 2.0 final and now can not use?!

[Illori]

they can use basic html by default but not the html tag due to the reasons above, if they could then you must have had a mod.

[KillsBR]

in version 2.0 rc4, I do not use any mod .... on my forum, everyone MUST to be able to use the tag

[Illori]

you would need a mod to do that which puts your forum and users at great risk of being hacked.

[KillsBR]

and this mod exist? xD

i foung this: http://custom.simplemachines.org/mods/index.php?mod=411
but not for 2.0 =[

[Illori]

you want all html to be used by your users or just basic html? there should be a check box on that page to enable basic html.

[KillsBR]

but is already marked =/

[Illori]

try unchecking saving and checking it again.

[KillsBR]

continues in the same =x

[Illori]

do you have any mods installed?

[KillsBR]

1.    Spoiler BBCode    1.1.3
2.    AJAX Instant Quick Reply    1.0.4
3.    Highslide BBCode and Image Viewer
4.    YouTube BBCode    2.6    
5.    AJAX Recent Topics    1.1    

[Illori]

any of those could affect this, try uninstall them and seeing it if works then, also users can just use basic html without the html bbc code tag.

[KillsBR]

without the tag, it's still the same

i will try unistall this mods

[KillsBR]

uninstalled everything and did not work ...

[Illori]

you are trying this in a post and not in the news right?

[KillsBR]

new topic and reply

[filipes]

I have the same problem can anyone help with this, thks....

[Arantor]

As has been outlined many times before: it is an extremely bad idea to allow non-admins to use this tag. It is insecure.

What content are you trying to allow them to post?

[filipes]

Hello
It is javascript......
thks

[Arantor]

Yes, that's nice and secure. You can do so many things with JavaScript, like stealing the logged in user session details and hijacking accounts.

So, again, what do you actually want users to be able to post and why?

[filipes]

Something like this..

Code Select Expand

[center][html]<script src="//www.gmodules.com/ig/ifr?url=http://hosting.gmodules.com/ig/gadgets/file/114026893455619160549/embedkmlgadget.xml&amp;up_kml_url=http%3A%2F%2Fdl.dropbox.com%2Fu%2F78748857%2FKML%2FPontos_negros.kml&amp;up_view_mode=earth&amp;up_earth_2d_fallback=0&amp;up_earth_fly_from_space=1&amp;up_earth_show_buildings=0&amp;up_maps_zoom_out=0&amp;synd=open&amp;w=600&amp;h=400&amp;title=&amp;border=%23ffffff%7C0px%2C1px+solid+%23004488%7C0px%2C1px+solid+%23005599%7C0px%2C1px+solid+%230077BB%7C0px%2C1px+solid+%230088CC&amp;output=js"></script>[/html][/center]

[Arantor]

What's that supposed to do, exactly?

[filipes]

It is a google map with positions of radar in Portugal.....

[Arantor]

I know the Aeva mod used to be able to safely insert Google maps just by posting the URL but I also know that Google changed its API to avoid free map inclusion after so many hits.

The thing is: if you allow that JS to be posted by regular members, you allow ANY scripting to be posted, which is incredibly unsafe for a forum.

[filipes]

I want to do that possible for two members only not to everybody...

[Arantor]

The simplest way is to make them admins. By giving them raw HTML posting access, you might as well make them admins since they can make themselves admins in theory should you grant them raw access to the HTML bbc.

[filipes]

How can I do this The simplest way is to make them admins. By giving them raw HTML posting access

[Arantor]

If they have raw posting access, they can take over your account and do whatever they want on the forum. That's the risk of giving them raw posting access.

If you make them admins, they have the same power but it's done in a manner that you can remove again, assuming they don't demote you.

[filipes]

Not like that, I think that is not a good thing like that, any other way?

[Arantor]

That's the point, I don't think there is any other way!

You could just let them post it and edit their post after to put the HTML bbc around it - it will let you do so because you're an admin.

[filipes]

Look at this it is in Portuguese, why does this not working....

[Arantor]

-sigh- Because for YOUR PROTECTION it is removed from the post when a non-administrator saves the post.

[filipes]

Ok, (Obrigado) thank you....hello from Portugal!