Forum Display Enhancements - IMG and URL security

This is a so called "hack". I wanted that my users with IE web browser don't get "IE explit" in IMG tags.

My problem was bigger, becouse I couldn't disable IMG tags, and teach users to use FF.

This hack is just a little file integrated addon. It works to IMG tags, and URL tags just fine.

Install

So, backup file: yoursite.com/forum/includes/class_bbcode.php. When you have a safty cope, you can begin with editing the file.

In class_bbcode.php find:

URL hack

	* Handles a [url] tag. Creates a link to another web page.

then scroll down till you see:

		// remove double spaces -- fixes issues with wordwrap
		$rightlink = str_replace('  ', '', $rightlink);

		// standard URL hyperlink
		return "<a href=\"$rightlink\" target=\"_blank\">$text</a>";

now you must replce the this code with:

		// remove double spaces -- fixes issues with wordwrap
		$rightlink = str_replace('  ', '', $rightlink);

		// URL hack
		if ( preg_match("#^http://([a-z0-9\-_\.]*)goodsite\.com/?(/(.*))?$#i" ,"$rightlink") 		){
		return "<a href=\"$rightlink\" target=\"_blank\">$text</a>"; 
		}
		else if ( preg_match("#^http://([a-z0-9\-_\.]*)goodsite2\.com/?(/(.*))?$#i" ,"$rightlink") ){
		return "<a href=\"$rightlink\" target=\"_blank\">$text</a>"; 
		else {
		return "<a href=\"$rightlink\" target=\"_blank\">$text</a> <strong>[Warning, this link can be a Virus link]</strong>"; 
}

Just replace the goodsite\.com with the site you know it's secure. Eg. yoursite

What it do ?

When posting, an URL like: goodsite.com it shows like http://goodsite.com
It works on: enything.etc.goodsite.com/enything, in all ways.
When you post a site like: hacksite.com it shows like http://hacksite.com [Warning, this link can be a Virus link]

Ok the second part is with a IMG tag, it's the same way. When you post a secure Image the image just shows, but when you post a Image, that isn't in the if () else () script, it shows only a link and a warning. I show this example with imageshac.us that is secure to me

IMG hack

In the same file find:

	* Handles a match of the [img] tag that will be displayed as an actual image.

Scroll down, and select:

		// remove double spaces -- fixes issues with wordwrap
		$link = str_replace('  ', '', $link);

		return '<img src="' .  $link . '" border="0" alt="" />';

replace it with:

		// remove double spaces -- fixes issues with wordwrap
		$link = str_replace('  ', '', $link);
		if ( preg_match("#^http://([a-z0-9\-_\.]*)imageshack\.us/?(/(.*))?$#i" ,"$link") ){
		return '<img src="' .  $link . '" border="0" alt="" />';
		}
		else if ( preg_match("#^http://([a-z0-9\-_\.]*)photobucket\.com/?(/(.*))?$#i" ,"$link") ){
		return '<img src="' .  $link . '" border="0" alt="" />';
		}
		else {
		return "<a href=\"$link\" target=\"_blank\">$link</a> <strong>[Warning, this link can be a Virus link]</strong>"; 
		}

Thats all, comments plax :P

[katilkuzu]

firts reserved for future, i will install after upgrading

[ZomgStuff]

Nice!

[bosal]

Originally Posted by katilkuzu

firts reserved for future, i will install after upgrading

you can try it on older versions, i made it for 3.6.4, but maybe the file is the same.

[Milad]

I thought this had been fixed in vB !!!

[Ntfu2]

i think all it does is add a warning next to links? I dunno im sorta confused by it all...

[ZomgStuff]

Nice! Thanks!

[Xoligy]

It appears to provide a warning if the site isn't trusted. Would a better method to do what slashdot does and show the main url next to it (eg. link [google.com])

[bosal]

I needed version like this, and I give you this version you change it in the way you want it.

With the IMG tag i allowed to show images only form imageshack.us etc. Exploit has no chance

[katilkuzu]

Originally Posted by bosal

you can try it on older versions, i made it for 3.6.4, but maybe the file is the same.

ok thanx installed ^'_'^