vb.org Archive

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   vB5 General Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=262)
-   -   Disable HTML Code - Security? (https://vborg.vbsupport.ru/showthread.php?t=317710)

shimei 03-12-2015 10:07 PM

Quote:

Originally Posted by ForceHSS (Post 2540293)
Can you post some screenshots with the code breaking and without and a link to your site so someone can give you the correct code if they can


Here's the result of having posted between either [ code ] or [ html ] tags as Lynne suggested. As you can see the entire site is wrecked (blank).

https://vborg.vbsupport.ru/external/2015/03/15.jpg

--------------- Added [DATE]1426201908[/DATE] at [TIME]1426201908[/TIME] ---------------

and here it is before I enter the code:

https://vborg.vbsupport.ru/external/2015/03/16.jpg

--------------- Added [DATE]1426202159[/DATE] at [TIME]1426202159[/TIME] ---------------

Quote:

Originally Posted by Replicant (Post 2540296)
If you are posting just the code in the original post, it probably will break the page since there is no closing tag for the table. If you want to view the raw html in the post, have you tried the noparse bbcode?
Code:

[noparse]<!--added table -->
<table class="forum-list-container stretch catspace">[/noparse]


Hello Replicant,

Thank you for your support. I have not, my concern at this point is that anyone can enter code into the browser by creating a thread or replying to a post and wrecking the site.

At this point, I'm hoping someone will tell me how to find the post in the database once the site has been wrecked?

Of course, I think this needs be looked at, and I was wondering if others are having this issue or is it my site alone? I am using VB 5.1.5. I am nervous about posting a link to my site here, all I need is for someone to to do this or keep doing it. My site would be down until this is fixed.

Thanks,
Shim

Replicant 03-12-2015 10:18 PM

Post the source from your post that is breaking the page here so we can see what you are doing.

shimei 03-12-2015 10:21 PM

I was copying this page to my forum section where I track the mods I have done to the site. I performed this mod successfully then created a thread and posted this page as a record of my changes. That's when I discovered I could wreck the site through entering any of this code into the browser/thread/post.

https://vborg.vbsupport.ru/showthread.php?t=309785

Wayne Luke 03-12-2015 10:31 PM

I tried to recreate this issue on a fresh installation of vBulletin 5.1.5 with no modifications. Using the [html] tags I get this result:

https://vborg.vbsupport.ru/external/2015/03/25.png

Using no BBCODE, I do get issues so that will need to be checked and tested more but it doesn't break the entire site. Here is what is does if no BBCode is used:

https://vborg.vbsupport.ru/external/2015/03/26.png

In both occurrences, the Can Use HTML permission is off globally for Administrators.

Though if you've made other changes to the templates and the above code is compounded on errors that browsers could work around, then this could cause more issues.

ForceHSS 03-12-2015 10:41 PM

As HTML seems to work for Wayne then it must be something you installed like a custom plugin or an edit to a template revert any templates and disable all plugins then test

shimei 03-12-2015 11:05 PM

Quote:

Originally Posted by ForceHSS (Post 2540311)
As HTML seems to work for Wayne then it must be something you installed like a custom plugin or an edit to a template revert any templates and disable all plugins then test

Hello ForceHSS,

Thank you for taking the time to respond. I noticed Wayne said:

Quote:

Using no BBCODE, I do get issues so that will need to be checked and tested more but it doesn't break the entire site. Here is what is does if no BBCode is used:
Later tonight I'll delete that mod and see if the issue is less than breaking the website. Perhaps they are related, that is having done the mod and then posting similar coding in a thread?

Thank you and I'll post the results.

Shim

ForceHSS 03-12-2015 11:23 PM

If you are going to remove the xml of a custom plugin also remove the files as well

Lynne 03-13-2015 01:18 AM

As Wayne said, I had no issues posting using the html code tag. If you are, then something else is amiss.


All times are GMT. The time now is 03:18 AM.

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.05022 seconds
  • Memory Usage 1,737KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)bbcode_code_printable
  • (4)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (1)pagenav_pagelink
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (8)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 

Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • pagenav_page
  • pagenav_complete
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete