Administrative and Maintenance Tools - Advanced BBCode (Use conditionals in BBCodes)

It kind of bothered me that you couldn't use vBulletin conditionals in the BBCodes. For example you couldn't use <if condition="$bbuserinfo[usergroupid] == {option}">{param}</if>.

With this small hack you can customize your BBCodes by using vBulletin's own conditionals.

Installing
Download the plugin XML. Go into to your ACP --> Plugins & Products --> Download / Upload Plugins. Scroll to the bottom of the page. Browse to vbulletin-plugins_adv_bbcodes.xml and click "Import".

View the screenshot for an example BBCode you can use.

[Muellmann]

For example:

<if condition="$bbuserinfo['userid']>0">{param}<else />This code is not visible for Guests</if>

or:

<if condition="$bbuserinfo['reputation']>=100">{param}<else />This code is only visible for reputation points.</if>

Other question security related:
I found out that it would parse vb variables directly in the post.
The question is if there is a security matter / issue or not?!
For example I can write in my post

$bbuserinfo[reputation]

and it would
directly in my post show my reputation value. So I am afraid it could be used by
members for malicious actions or is this impossible?

[harmor19]

The conditionals work for me.

It's not really a security risk but you may have data you don't want them to see.

[Murty]

Could you use this to specify the bbcode to only be used in a particular forum? If so, what code would you use?

[AzzidReign]

Hmmm, interesting. I'm going to click install for now and download and install this to my site later!

[harmor19]

There are a two problems with this mod. One is where a member can type $bbuserinfo[var] and it will output the value in the database but only for their userid. I used preg_replace to fix the problem.
Another is when someone types an array with either single or double quotes $var['foo'] or $var["foo"].
Can anybody help with the second problem?

[mhmd1983]

Great mod , even with the simple example you wrote it'll be much fun to use it

[WAR]

Did you include the fix for the first problem in the plugin yet?

For restricting multiple usergroups, can you use the is_member_of() function instead of the boolean operator? (I know that this works in templates, not sure about here)

Example:

<if condition="is_member_of($bbuserinfo,{option})">{pa ram}</if>

[bbcode_name=5,6]visible to mods and admins only[/bbcode_name]

or you might need quotes, depending on how things are parsed, and whether or not this is related to problem #2 above:

[bbcode_name='5,6']visible to mods and admins only[/bbcode_name]

I am concerned about the security risk, because I have a ton of private/hidden profile fields with personal information about my users that I wouldn't want people to have access to

[raywjohnson]

Originally Posted by Muellmann

Other question security related:
I found out that it would parse vb variables directly in the post.
The question is if there is a security matter / issue or not?!
For example I can write in my post

$bbuserinfo[reputation]

and it would
directly in my post show my reputation value. So I am afraid it could be used by
members for malicious actions or is this impossible?

Installed and working great! But, is there any security/abuse concern here? Can this be exploited?

--RayJ

[raywjohnson]

Originally Posted by harmor19

There are a two problems with this mod. One is where a member can type $bbuserinfo[var] and it will output the value in the database but only for their userid. I used preg_replace to fix the problem.
Another is when someone types an array with either single or double quotes $var['foo'] or $var["foo"].
Can anybody help with the second problem?

I have some concern about this, could you give an example of the preg_replace regex and where to put it? I would guess it would go in the plugin, but before or after the

PHP Code:

eval('$text = "' . compile_template($text) . '" ;'); 


?

Thanks for any info!

--RayJ

PS:

PHP Code:

My failed attempt: eval(preg_replace('/(\$)(show|stylevar|userinfo|vboptions|vbphrase)(\[.+\])/i',"$1 $2 $3",$text)); 


[raywjohnson]

It seems as if this only works on new/updates posts. It fails to function for bbcodes in the post-cache. Any info on how to fix this?

Thanx, RayJ