Recent Topics

1 Apr 05, 2005 10:21    

Validity & Security Checking

Hi Guys:
I want to inject HTML, XHTML and Java script into my Blog postings. And yes, I do understand the dangers of XSS. One of the ways I?m told EVIL code can be injected into your Blog giving hackers access to your back office workings, is if a member places it in the post and only if Security Checking is turned off. My blog is exclusive, outside of myself I have two other trusted staff members, and we have a need to turn part of Security Checking off.

I understand I must set ($use_html_checker = 0;) and ($use_security_checker = 1;) in order to turn off Security Checking. However, I don?t want to turn it off for comments, I just want to turn it off for posting, not comments. How can this be done? Should both settings be zero?

Dougx

2 Nov 21, 2005 09:54

Doug,

I had the same problem and I think I found a solution. I'm far from a PHP coder much less guru and I know nothing about B2E but I really needed to disable all checking for posts (because I'm the only poster) but wanted to keep it for comments.

Here's what I did:

In /b2evocore/_functions.php around line 360 change this code

	if( $use_html_checker )

	{	// Check the code:

		if( ! $is_comment )

		{

			$checker = & new SafeHtmlChecker( $allowed_tags, $allowed_attribues,

																			$uri_attrs, $allowed_uri_scheme );

		}


To this code

	if( $use_html_checker )

	{	// Check the code:

		if( ! $is_comment )

		{

	return($content);

		}

As I read it, it is saying if the check flag is on and it's not a comment then do the checking like this. My change says if the check flag is on and it's not a comment then just return. It appears to work in my cursory testing (trying to put code in a comment and failing, the putting code in a post and succeeding). But this is dangerous stuff and no one should take my word for it on its own.

This is just a quick and dirty hack. It would be great if someone that knows some PHP could setup two variables: use_html_checker_posts and use_html_checker_comments. It would be handy to have that option in a future version.

Hope this helps someone

--- Mark

3 Feb 19, 2006 05:47

Was this ever added? I see a need for this as I am the only poster and no one can post except me....

thanks.

4 May 15, 2006 02:13

Anyone know how to do this in 1.6?

5 Nov 05, 2006 08:02

would like to know this in 1.8.2 ... or a plugins ?

6 Nov 18, 2006 18:07

in 1.8.2 it's in

inc/_misc/_misc.funcs.php

at line 180


Form is loading...