Go Back   vb.org Archive > vBulletin 5 Connect Discussion > vB5 General Discussions

Reply
 
Thread Tools Display Modes
  #1  
Old 03-09-2015, 11:30 PM
shimei shimei is offline
 
Join Date: Feb 2015
Posts: 216
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default Disable HTML Code - Security?

Hello,

I was wondering whether others were experiencing the same issues as I am. I keep notes by tracking the forum changes I make. I tried to post the following code into my VB 5.1.5 under an admin account:

Code:
<!--added table -->
<table class="forum-list-container stretch catspace">
It breaks the site's layout. I went to usergroup permissions and disabled Allow HTML Code, I also checked Channel Permissions.

I feel like my site is a sitting duck awaiting for someone to wreck havoc on it.
Reply With Quote
  #2  
Old 03-10-2015, 07:10 PM
Lynne's Avatar
Lynne Lynne is offline
 
Join Date: Sep 2004
Location: California/Idaho
Posts: 41,180
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

You tried to post that code where? You are posting it in a thread? If so, post it in [ code ] tags.
Reply With Quote
  #3  
Old 03-11-2015, 05:18 PM
shimei shimei is offline
 
Join Date: Feb 2015
Posts: 216
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Quote:
Originally Posted by Lynne View Post
You tried to post that code where? You are posting it in a thread? If so, post it in [ code ] tags.
Hi Lynne,

That's exactly what I had done. I make notes in the forum of the changes I make to the website. I put that in the code tags of a thread. Regardless, it breaks the layout.
Reply With Quote
  #4  
Old 03-12-2015, 05:58 PM
Lynne's Avatar
Lynne Lynne is offline
 
Join Date: Sep 2004
Location: California/Idaho
Posts: 41,180
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Are you putting the html in HTML tags or CODE tags? Now that I think about it, CODE tags will 'parse' what is in there; HTML tags should not.
Reply With Quote
  #5  
Old 03-12-2015, 07:39 PM
shimei shimei is offline
 
Join Date: Feb 2015
Posts: 216
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Hello Lynne,

I am a little unclear about what you mean. I pasted in plain text in code tags.

In or out of the [ code ] tags the code disappears and wrecks the site. Luckily I was able to delete the post because I was still looking on it and did not navigate away from it on one browser. If I even post the following:

<!-- Categories -->

The above code cannot be seen in my page in or outside the code tags. Is this a security issue? I can't see how it isn't because all one needs do is post some code in the browser and my site is wrecked on 5.1.5. I have set no to allow html code wherever it is an option in the admincp, and that's the only thing I could come close to assuming that would prevent it.

I have filled out a support ticket with Vbulletin but it has been days and no solution. If someone post a code into the browser and my site goes down how can I find the post when no posts are visible. Would I have to go to the database and find the culprit post and delete it?

Thanks William
Reply With Quote
  #6  
Old 03-12-2015, 08:39 PM
ForceHSS ForceHSS is offline
 
Join Date: Apr 2008
Posts: 6,357
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

If you allow the admin group to post html code and allow html in the section you need it should work if you only want yourself to post html code make a new admin group and move yourself to it then give that group only html permissions.
Warning: html coding can break your site and cause security problems if you don't know what you are doing
Reply With Quote
  #7  
Old 03-12-2015, 08:46 PM
shimei shimei is offline
 
Join Date: Feb 2015
Posts: 216
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Quote:
Originally Posted by ForceHSS View Post
If you allow the admin group to post html code and allow html in the section you need it should work if you only want yourself to post html code make a new admin group and move yourself to it then give that group only html permissions.
Warning: html coding can break your site and cause security problems if you don't know what you are doing
Right, I had disabled html coding in all groups and channel permissions. The result is the same and which led me to posting this.

Thanks for your time though,
Shim
Reply With Quote
  #8  
Old 03-12-2015, 08:51 PM
ForceHSS ForceHSS is offline
 
Join Date: Apr 2008
Posts: 6,357
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Can you post some screenshots with the code breaking and without and a link to your site so someone can give you the correct code if they can
Reply With Quote
  #9  
Old 03-12-2015, 09:02 PM
Replicant's Avatar
Replicant Replicant is offline
 
Join Date: Sep 2014
Location: Phoenix, Az. USA
Posts: 485
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

If you are posting just the code in the original post, it probably will break the page since there is no closing tag for the table. If you want to view the raw html in the post, have you tried the noparse bbcode?
Code:
[noparse]<!--added table -->
<table class="forum-list-container stretch catspace">[/noparse]
Reply With Quote
  #10  
Old 03-12-2015, 09:35 PM
Lynne's Avatar
Lynne Lynne is offline
 
Join Date: Sep 2004
Location: California/Idaho
Posts: 41,180
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Quote:
Originally Posted by shimei View Post
Hello Lynne,

I am a little unclear about what you mean. I pasted in plain text in code tags.
I mean you should use [ HTML ] tags instead of [ CODE ] tags.

HTML Code:
<!--added table -->
<table class="forum-list-container stretch catspace">
not
Code:
<!--added table -->
<table class="forum-list-container stretch catspace">
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT. The time now is 08:23 AM.


Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2024, vBulletin Solutions Inc.
X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.05875 seconds
  • Memory Usage 2,246KB
  • Queries Executed 13 (?)
More Information
Template Usage:
  • (1)SHOWTHREAD
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)ad_showthread_beforeqr
  • (1)ad_showthread_firstpost
  • (1)ad_showthread_firstpost_sig
  • (1)ad_showthread_firstpost_start
  • (3)bbcode_code
  • (1)bbcode_html
  • (3)bbcode_quote
  • (1)footer
  • (1)forumjump
  • (1)forumrules
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (1)navbar
  • (3)navbar_link
  • (120)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (1)pagenav_pagelink
  • (10)post_thanks_box
  • (10)post_thanks_button
  • (1)post_thanks_javascript
  • (1)post_thanks_navbar_search
  • (10)post_thanks_postbit_info
  • (10)postbit
  • (10)postbit_onlinestatus
  • (10)postbit_wrapper
  • (1)spacer_close
  • (1)spacer_open
  • (1)tagbit_wrapper 

Phrase Groups Available:
  • global
  • inlinemod
  • postbit
  • posting
  • reputationlevel
  • showthread
Included Files:
  • ./showthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/functions_bigthree.php
  • ./includes/class_postbit.php
  • ./includes/class_bbcode.php
  • ./includes/functions_reputation.php
  • ./includes/functions_post_thanks.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_postinfo_query
  • fetch_postinfo
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • showthread_start
  • showthread_getinfo
  • forumjump
  • showthread_post_start
  • showthread_query_postids
  • showthread_query
  • bbcode_fetch_tags
  • bbcode_create
  • showthread_postbit_create
  • postbit_factory
  • postbit_display_start
  • post_thanks_function_post_thanks_off_start
  • post_thanks_function_post_thanks_off_end
  • post_thanks_function_fetch_thanks_start
  • post_thanks_function_fetch_thanks_end
  • post_thanks_function_thanked_already_start
  • post_thanks_function_thanked_already_end
  • fetch_musername
  • postbit_imicons
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • postbit_display_complete
  • post_thanks_function_can_thank_this_post_start
  • pagenav_page
  • pagenav_complete
  • tag_fetchbit_complete
  • forumrules
  • navbits
  • navbits_complete
  • showthread_complete