PDA

View Full Version : Miscellaneous Hacks - Thread/Post Title Characters


MarkFL
12-22-2016, 10:00 PM
Overview:

This simple product allows you to define what chracters will be permitted in thread/post titles using regex. You may elect to use HTML5 form validation when the user's browser supports it, but if you choose not to use this method, or the user's browser doesn't support it, then a message will be displayed above the editor block advising the user that they have illegal characters in their thread/post title if applicable. They will not be allowed to submit their post until the title has the illegal characters removed. You may define the CSS applied to the error message.

If a user has illegal characters in their thread/post title, and you have HTML5 form validation on and the user's browser supports the validation, then when they attempt to preview or submit their post, they will see something like:

https://vborg.vbsupport.ru/attachment.php?attachmentid=155592&stc=1&d=1482494017

Otherwise, they will see something like:

https://vborg.vbsupport.ru/attachment.php?attachmentid=155593&stc=1&d=1482494017

Compatibility:

Tested and working on VB 4.2.x and may work on all 4.x versions of vBulletin.

Backup/Warning:

This product does not alter your database, however it is always good practice to make regular backups and you should make a backup before installing ANY new mod.

As always, products are USE AT YOUR OWN RISK. I will provide support and do my best to help but no absolute guarantee is offered.

To Install:


Download and extract the attached .zip file.
Follow AdminCP -> Plugins & Products -> Manage Products -> Add/Import Product.
Click on "Choose File" and browse to the product .xml file that was packaged in the .zip file.
Click "Import."
You MUST enable the product in the settings before it will function.
Configure the remaining settings to your liking. Each setting has a detailed explanation of its use.


https://vborg.vbsupport.ru/attachment.php?attachmentid=155594&stc=1&d=1482494017

Support for this product can be found here:


MHB - Thread/Post Title Characters (http://mathhelpboards.com/vbulletin-products-61/thread-post-title-characters-21778.html)
TAZ - Thread/Post Title Characters (https://theadminzone.com/threads/thread-post-title-characters.144997/)

Snowhog
12-23-2016, 07:30 PM
MarkFL has cited me as a Co-Author of this MOD, but my contribution was a request to vBulletin for a MOD that would do this. I don't write vBulletin MODS. I don't have the knowledge or skills to do so, rather, I'm an 'idea guy'.

I am continually amazed at the support I receive here in this Forum. Several members; MarkFL among them; have been willing and able to assist me in developing unique tools (MODs/Plugins) that address specific concerns I have in our Forum. This MOD/Plugin addresses a likely unique situation that has happened on our Forum due to our use of ZB Block. In short, it will greatly minimize (if not entirely prevent) Post/Thread Titles from being interpreted by ZB Block as possible SQL Injection vectors, a condition that has happened when non-alphanumeric characters were used.

Thank you MarkFL!

MarkFL
12-23-2016, 07:38 PM
Glad to help out, Paul...and if others find this useful then that's just icing on the cake. :D

Stratis
12-24-2016, 01:50 PM
I assume this only works with English language? with a little try.
I did not manage to make it work in Greek [Α-Ω] :)

MarkFL
12-24-2016, 02:29 PM
Yes, as it stands now, non-Latin characters are not supported.

Snowhog
12-25-2016, 09:11 PM
I changed "illegal" to "prohibited" in the message text. Comes across a little bit nicer and accurately conveys what "we" are doing; prohibiting the use of all but the allowed characters shown in the message.

MarkFL
12-25-2016, 10:08 PM
I changed "illegal" to "prohibited" in the message text. Comes across a little bit nicer and accurately conveys what "we" are doing; prohibiting the use of all but the allowed characters shown in the message.

That was one reason I phrased the messages, so they can be customized and translated. :)

Snowhog
12-26-2016, 08:37 PM
Would you change the word illegal to prohibited in the Overview?

Snowhog
01-02-2017, 12:32 AM
Discovered a problem.

If one has Require Threads to have a Prefix in Forum Manager set to Yes, this MOD is triggered. Not what we want.

MarkFL
01-02-2017, 08:43 AM
Discovered a problem.

If one has Require Threads to have a Prefix in Forum Manager set to Yes, this MOD is triggered. Not what we want.

I'm not getting this behavior on my local dev site. :confused:

Snowhog
01-02-2017, 04:01 PM
I've set Require Threads to have a Prefix to No and the MOD doesn't get triggered. We have only one forum where I had this requirement, which is why I hadn't noticed this before this. All our other forums don't have this as a requirment.

All Thread Prefixes I created are encased in [], so I thought it was those characters triggering the MOD (they aren't in the defined approved character list). I added them to the approved characters, but that forum was still being triggered by the MOD if I had Require Threads to have a Prefix set to Yes, even when the Thread Title contained only alpha-numeric characters.

Can you suggest what I might want to examine to help why this is happening on our site and not yours?

MarkFL
01-02-2017, 05:43 PM
My prefixes are also wrapped in square brackets, and I did not add the brackets to the approved character list, and I changed one of my forums to require a prefix, and the title did not cause an error, unless there were illegal characters actually in the title.

At the moment, I have no idea why you are getting this issue on your site. :(

Snowhog
01-02-2017, 06:51 PM
For the time being I'm keeping the Require Threads to have a Prefix in the affected forum set to No, and have unchecked the two Prefix sets.

Something else I noticed. Adding ' to the character set and clicking on Post New Thread resulted in the entire site page not loading; just a blank page.

1st image: Preview of new thread when Thread Prefix is required.
2nd image: Preview of new thread when Thread Prefix is not required.
3rd image: MOD settings.
4th image: Affected forum Features settings.
5th image: Our installed products (1st page)
6th image: Our installed products (2nd page)

MarkFL
01-02-2017, 07:23 PM
You will have to escape that character...add \' to the allowed characters. You will also need to escape the dash and the forward slash. Use:

[a-zA-Z0-9\,\-\/\' ]

Snowhog
01-02-2017, 07:51 PM
My brother-in-law and I were just discussing this issue, and he asked if I had escaped any of the non-alphanumeric characters. I hadn't, but didn't think I needed to (should have known better -- Regular Expression rules ya know).

Just escaped them and no false triggering of the MOD. Interestingly, it also answers (I think) why the MOD was being triggered when the title contained only alpha-numeric characters; it was triggered because I had unescaped characters in the MOD list! At least, that's what I think is/was the cause, as with those characters now properly escaped, a title with only alpha-numeric characters doesn't trigger the MOD.

Thank you very much.:up:

MarkFL
01-02-2017, 10:06 PM
Glad to hear all is well now! :)

Inna
01-21-2017, 07:35 PM
Is there any mod acts like this when users registering?
I mean I don't want my guest be allowed to register with non-English letters (only a-z capital and small, and 0-9)

MarkFL
01-21-2017, 08:03 PM
Is there any mod acts like this when users registering?
I mean I don't want my guest be allowed to register with non-English letters (only a-z capital and small, and 0-9)

vBulletin has that feature built in...follow:

AdminCP -> Options -> Settings -> User Registration Options

Find the setting "Username Regular Expression"

and enter there:

^[A-Z0-9 ]+$

:)