[profanitytalker]

Originally Posted by T2x

The mod apparently looks for ranker embed codes when posts are made and pulls out a few variables then generates a bb code tag which vbulletin automatically sanitizes.

When parsing the post for bbcode, if the user has image posting permissions it will generate this code

PHP Code:

'<a role="link" class="rnkrw-widget" data-rnkrw-id="'.intval($matches[1]).
'" data-rnkrw-width="'.$rankerwidgetwidth.'" data-rnkrw-rows="'.$rankernumitems.
'" href="'.htmlspecialchars_uni($matches[2]).'">'.htmlspecialchars_uni($matches[3]).
'</a><script id="rnkrw-loader" type="text/javascript" async="true" src="//widget.ranker.com/static/rnkrw2.js"></script>
<script>var RNKRW = RNKRW || {};RNKRW.pref = {"header":{"image":true}};</script>' 


I can also see they are preventing xss injection in the href attribute by validating that the url conforms to this regex:

https?:\/\/www\.ranker\.com\/[a-z0-9\-\/_]+

I appreciate verifying the plugin. Cheers to ya! :up: We made sure that the plugin is safe to install. I think Birdsofprey was referencing the last post I made (no plugin) where I suggested to enable HTML on the board - which is a big no no.