Miscellaneous Hacks - CES Parser Permissions

CES Parser Permissions
vBulletin 3.6.x, 3.7.x, 3.8.x, 4.0.x supported
Version: 2.2.3

If you encounter what you think may be a bug, please include your vBulletin version number when reporting it, since code and fixes differ greatly from 3.6.4 - 3.8.x.

*** NEWS ***
11/8/2010 - 2.2.3 released
5/15/2010 - 2.2.2 released
4/12/2009 - 3.6.x thread separated

Known Issues:
- If you are using the Advanced BB-Code Permissions hack, conflicts can arise when profile fields are parsed in the postbit, causing nothing be parsed. The fix is described here: https://vborg.vbsupport.ru/showthread.php?p=1252480

What It Does:
Allows you to grant only certain usergroups the ability to use HTML, BB-code, smilies, and IMG-code in their profile fields, posts, PMs, and in Project Tools.

Mod Features:
- parse profile fields on user profiles using Usergroup Permissions
- parse profile fields in postbits using Usergroup Permissions
- parse posts using Usergroup Permissions
- parse calendar events using Usergroup Permissions
- parse private messages using Usergroup Permissions
- parse Project Tools issues and replies using Usergroup Permissions
- parse Social Messages and usernotes using Usergroup Permissions
- complete Forum Rules integration
- disallow certain HTML tags

Products to Install: 1
Files to Upload: 3
Files to Edit: 0
Template Edits: 0

*** Changelog ***
As of Version 2.2.3

• non-forum messages don't parse
• poll options don't parse

As of Version 2.2.2

• several bug fixes
• compatible with VaultWiki 2.5.7 PL 1 & 3.0.0 RC 3

* This mod is offered for free here. Please donate if you like this mod *

[thincom2000]

Well if this next build of mine still has issues for you, then I would probably have to see your code to know for sure.

[cheesegrits]

Strangely enough, I still have this problem if I disable my mod and just use the standard About Me. The problem seems to be that when the bbcode_parse_start hook is called, class_bbcode.pl, the $bbfoo variables are undefined because of these lines:

PHP Code:

            default:
                if (intval($forumid))
                {
                    $forum = fetch_foruminfo($forumid);
                    $dohtml = $forum['allowhtml'];
                    $dobbimagecode = $forum['allowimages'];
                    $dosmilies = $forum['allowsmilies'];
                    $dobbcode = $forum['allowbbcode'];
                }
                // else they'll basically just default to false -- saves a query in certain circumstances
                break; 


... because $forumid is set to 'ces_profile' (not an intval), so as the comment says, they default to false. So then when we hit this part of ces_permissions_parse():

PHP Code:

        $dobbcode = ($check_ugp['can_bbcode_' . $parser->ces_options['check_type']] AND $dobbcode);
        $dosmilies = ($check_ugp['can_smilies_' . $parser->ces_options['check_type']] AND $dosmilies);
        $dobbimagecode = ($check_ugp['can_imgcode_' . $parser->ces_options['check_type']] AND $dobbimagecode);
        $dohtml = ($check_ugp['can_html_' . $parser->ces_options['check_type']] AND $dohtml); 


... they of course all end up false, because none of the $bbfoo variables are true.

I'm puzzled how this could be working for anybody, unless I somehow have an older version of the code?

-- hugh

[thincom2000]

Because $forumid is set to 'ces_profile', yes you are correct that $dofoo all default to false. However, the permissions for 'ces_profile' are cached before entering $bbcode->parse, so the CES Permissions skips the entire $dofoo = ($checkugp AND $dofoo) branch (see function ces_permissions_customfields to verify).

PHP Code:

$pf_parser->ces_options['ces_profile'][$userinfo['userid']] = convert_bits_to_array($userinfo['permissions']['ces_parser_permissions'], $vbulletin->bf_ugp['ces_parser_permissions']); 


This is then caught in ces_permissions_parse by:

PHP Code:

if (!empty($parser->ces_options["$forumid"][$parser->ces_options['current_userid']])) 


and refills $bbfoo with the appropriate values.

[cheesegrits]

Which would be OK, if these lines:

PHP Code:

    if ($post['userid'] AND $parser->ces_options['current_userid'] != $post['userid'])
    {
        $parser->ces_options['current_userid'] = $post['userid'];
    } 


... weren't resetting current_userid to the id of whoever happened to post the last Visitor Message.

So the code after that is looking for the wrong cached permissions, not finding them, and executing the wrong branch (the stuff that AND's with the $bbfoo's).

EIDT ... changing that 'if' to this seems to fix it.

PHP Code:

    if ($forumid != 'ces_profile' AND $post['userid'] AND $parser->ces_options['current_userid'] != $post['userid']) 


Although as before, I haven't done any corner case testing, so who knows if that'll break something else ...

-- hugh

[thincom2000]

Ah thank you. Fixed in next build.

[cheesegrits]

No problem. I really like this mod, and I want to make my AboutMe stuff "CES Permissions aware", so I look forward to the next build. If you'd like me to do some pre-release testing, PM me and I'll give you my email.

-- hugh

[Caerydd]

This looks great. However, as you have to enable html for all forums - the posting rules will show html 'on' for usergroups that don't have permission to post html. Anyway around this, save hiding posting rules?

[thincom2000]

There is a plugin in the product that should take care of the posting rules. Is this just speculation of yours or can you confirm that the posting rules are not updated?

[thincom2000]

A number of plugins had to be added in order to circumvent the default VM restrictions, and I believe I had to break the "bb-code X is not allowed" error system, but I have made the VM system flexible so that individual BB-Codes can be disabled and simply won't parse (or appear in the editor).

@ cheesegrits, I made some small changes to the forumrules plugin since I sent you the test version.

[thincom2000]

Okay, for the users who experience a blank page on member.php, this has been confirmed to be a result of running PHP 4 when there is a call to a function that didn't exist until PHP 5. Until the next update, you can fix this issue by adding the following code under the header of the includes/ces_permissions.php file:

PHP Code:

if (!function_exists('htmlspecialchars_decode'))
{
    function htmlspecialchars_decode($string, $quote_style = ENT_COMPAT)
    {
        return strtr($string, array_flip(get_html_translation_table(HTML_SPECIALCHARS, $quote_style)));
    }
}