Validity & Security Checking
Hi Guys:
I want to inject HTML, XHTML and Java script into my Blog postings. And yes, I do understand the dangers of XSS. One of the ways I?m told EVIL code can be injected into your Blog giving hackers access to your back office workings, is if a member places it in the post and only if Security Checking is turned off. My blog is exclusive, outside of myself I have two other trusted staff members, and we have a need to turn part of Security Checking off.
I understand I must set ($use_html_checker = 0;) and ($use_security_checker = 1;) in order to turn off Security Checking. However, I don?t want to turn it off for comments, I just want to turn it off for posting, not comments. How can this be done? Should both settings be zero?
Dougx
Doug,
I had the same problem and I think I found a solution. I'm far from a PHP coder much less guru and I know nothing about B2E but I really needed to disable all checking for posts (because I'm the only poster) but wanted to keep it for comments.
Here's what I did:
In /b2evocore/_functions.php around line 360 change this code
To this code
As I read it, it is saying if the check flag is on and it's not a comment then do the checking like this. My change says if the check flag is on and it's not a comment then just return. It appears to work in my cursory testing (trying to put code in a comment and failing, the putting code in a post and succeeding). But this is dangerous stuff and no one should take my word for it on its own.
This is just a quick and dirty hack. It would be great if someone that knows some PHP could setup two variables: use_html_checker_posts and use_html_checker_comments. It would be handy to have that option in a future version.
Hope this helps someone
--- Mark