PDA

View Full Version : Forum Display Enhancements - IMG and URL security


bosal
02-21-2007, 10:00 PM
This is a so called "hack". I wanted that my users with IE web browser don't get "IE explit" in IMG tags.

My problem was bigger, becouse I couldn't disable IMG tags, and teach users to use FF.

This hack is just a little file integrated addon. It works to IMG tags, and URL tags just fine.

Install

So, backup file: yoursite.com/forum/includes/class_bbcode.php. When you have a safty cope, you can begin with editing the file.

In class_bbcode.php find:

URL hack

* Handles a [url] tag. Creates a link to another web page.

then scroll down till you see:
// remove double spaces -- fixes issues with wordwrap
$rightlink = str_replace(' ', '', $rightlink);

// standard URL hyperlink
return "<a href=\"$rightlink\" target=\"_blank\">$text</a>";

now you must replce the this code with:


// remove double spaces -- fixes issues with wordwrap
$rightlink = str_replace(' ', '', $rightlink);

// URL hack
if ( preg_match("#^http://([a-z0-9\-_\.]*)goodsite\.com/?(/(.*))?$#i" ,"$rightlink") ){
return "<a href=\"$rightlink\" target=\"_blank\">$text</a>";
}
else if ( preg_match("#^http://([a-z0-9\-_\.]*)goodsite2\.com/?(/(.*))?$#i" ,"$rightlink") ){
return "<a href=\"$rightlink\" target=\"_blank\">$text</a>";
else {
return "<a href=\"$rightlink\" target=\"_blank\">$text</a> <strong>[Warning, this link can be a Virus link]</strong>";
}

Just replace the goodsite\.com with the site you know it's secure. Eg. yoursite :)

What it do ?

When posting, an URL like: goodsite.com it shows like http://goodsite.com
It works on: enything.etc.goodsite.com/enything, in all ways.
When you post a site like: hacksite.com it shows like http://hacksite.com [Warning, this link can be a Virus link]

Ok the second part is with a IMG tag, it's the same way. When you post a secure Image the image just shows, but when you post a Image, that isn't in the if () else () script, it shows only a link and a warning. I show this example with imageshac.us that is secure to me :)

IMG hack

In the same file find:
* Handles a match of the [img] tag that will be displayed as an actual image.


Scroll down, and select:
// remove double spaces -- fixes issues with wordwrap
$link = str_replace(' ', '', $link);

return '<img src="' . $link . '" border="0" alt="" />';

replace it with:

// remove double spaces -- fixes issues with wordwrap
$link = str_replace(' ', '', $link);
if ( preg_match("#^http://([a-z0-9\-_\.]*)imageshack\.us/?(/(.*))?$#i" ,"$link") ){
return '<img src="' . $link . '" border="0" alt="" />';
}
else if ( preg_match("#^http://([a-z0-9\-_\.]*)photobucket\.com/?(/(.*))?$#i" ,"$link") ){
return '<img src="' . $link . '" border="0" alt="" />';
}
else {
return "<a href=\"$link\" target=\"_blank\">$link</a> <strong>[Warning, this link can be a Virus link]</strong>";
}


Thats all, comments plax :P

katilkuzu
02-22-2007, 07:57 PM
firts reserved :) for future, i will install after upgrading

ZomgStuff
02-22-2007, 08:47 PM
Nice!

bosal
02-22-2007, 08:51 PM
firts reserved :) for future, i will install after upgrading

you can try it on older versions, i made it for 3.6.4, but maybe the file is the same.

Milad
02-23-2007, 12:05 AM
I thought this had been fixed in vB !!!

Ntfu2
02-23-2007, 02:13 AM
i think all it does is add a warning next to links? I dunno im sorta confused by it all...

ZomgStuff
02-23-2007, 04:06 AM
Nice! Thanks!

Xoligy
02-23-2007, 11:04 AM
It appears to provide a warning if the site isn't trusted. Would a better method to do what slashdot does and show the main url next to it (eg. link [google.com])

bosal
02-23-2007, 07:02 PM
I needed version like this, and I give you this version :) you change it in the way you want it.

With the IMG tag i allowed to show images only form imageshack.us etc. Exploit has no chance :)

katilkuzu
02-23-2007, 11:33 PM
you can try it on older versions, i made it for 3.6.4, but maybe the file is the same.

ok thanx installed ^'_'^

Zia
02-24-2007, 03:46 PM
interesting idea..
but there might be a need to add multiple trusted site or good site..
like with imageshack ,photobucket or more others.
every time need to edit the template ? :confused: lengthy

bosal
02-24-2007, 06:27 PM
yep :( maybe when i have some time I make this like a plugin :)

Zia
02-25-2007, 03:04 AM
:P when u will have some time ? :D

bosal
02-25-2007, 11:39 AM
:) I don't know

masoud_sun
12-29-2007, 02:20 PM
Nice! Thanks!

Good

bulbasnore
05-31-2012, 01:06 PM
Wanted to say, we use this to restrict images to our gallery, which is moderated.