tags (PHP 5.3.0+)
// $config['markup'][] = array(
diff --git a/inc/functions.php b/inc/functions.php
index 119079a6..1f702ba0 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -1451,6 +1451,39 @@ function markup(&$body, $track_cites = false) {
$body = str_replace("\r", '', $body);
$body = utf8tohtml($body);
+ if (preg_match_all('@<tinyboard ([\w\s]+)>(.+)</tinyboard>@um', $body, $modifiers, PREG_SET_ORDER | PREG_OFFSET_CAPTURE)) {
+ $skip_chars = 0;
+ $body_tmp = $body;
+
+ foreach ($modifiers as $modifier) {
+ // preg_match_all is not multibyte-safe
+ foreach ($modifier as &$match) {
+ $match[1] = mb_strlen(substr($body_tmp, 0, $match[1]));
+ }
+
+ $modifier['type'] = $modifier[1][0];
+ $modifier['content'] = $modifier[2][0];
+
+ if ($modifier['type'] == 'ban message') {
+ // Public ban message
+ $replacement = sprintf($config['mod']['ban_message'], $modifier['content']);
+ } elseif ($modifier['type'] == 'raw html') {
+ $body = html_entity_decode($modifier['content']);
+ return array();
+ } elseif (preg_match('/^escape /', $modifier['type'])) {
+ // Escaped (not a real modifier)
+ $replacement = '<tinyboard ' . substr($modifier['type'], strlen('escape ')) . '>' . $modifier['content'] . '</tinyboard>';
+ } else {
+ // Unknown
+ $replacement = '';
+ }
+
+ $body = mb_substr_replace($body, $replacement, $modifier[0][1] + $skip_chars, mb_strlen($modifier[0][0]));
+ $skip_chars += mb_strlen($replacement) - mb_strlen($modifier[0][0]);
+
+ }
+ }
+
if (mysql_version() < 50503)
$body = mb_encode_numericentity($body, array(0x010000, 0xffffff, 0, 0xffffff), 'UTF-8');
@@ -1492,7 +1525,7 @@ function markup(&$body, $track_cites = false) {
$tracked_cites = array();
// Cites
- if (isset($board) && preg_match_all('/(^|\s)>>(\d+?)([\s,.)?]|$)/m', $body, $cites, PREG_SET_ORDER | PREG_OFFSET_CAPTURE)) {
+ if (isset($board) && preg_match_all('/(^|\s)>>(\d+?)([\s,.)?]|$)/m', $body, $cites, PREG_SET_ORDER | PREG_OFFSET_CAPTURE)) {
if (count($cites[0]) > $config['max_cites']) {
error($config['error']['toomanycites']);
}
@@ -1591,6 +1624,10 @@ function markup(&$body, $track_cites = false) {
return $tracked_cites;
}
+function escape_markup_modifiers($string) {
+ return preg_replace('@(.+) @m', '$2 ', $string);
+}
+
function utf8tohtml($utf8) {
return htmlspecialchars($utf8, ENT_NOQUOTES, 'UTF-8');
}
diff --git a/inc/mod/pages.php b/inc/mod/pages.php
index 08604039..351d3203 100644
--- a/inc/mod/pages.php
+++ b/inc/mod/pages.php
@@ -507,6 +507,7 @@ function mod_noticeboard($page_no = 1) {
if (!hasPermission($config['mod']['noticeboard_post']))
error($config['error']['noaccess']);
+ $_POST['body'] = escape_markup_modifiers($_POST['body']);
markup($_POST['body']);
$query = prepare('INSERT INTO `noticeboard` VALUES (NULL, :mod, :time, :subject, :body)');
@@ -568,6 +569,7 @@ function mod_news($page_no = 1) {
if (!hasPermission($config['mod']['news']))
error($config['error']['noaccess']);
+ $_POST['body'] = escape_markup_modifiers($_POST['body']);
markup($_POST['body']);
$query = prepare('INSERT INTO `news` VALUES (NULL, :name, :time, :subject, :body)');
@@ -737,6 +739,7 @@ function mod_page_ip($ip) {
if (!hasPermission($config['mod']['create_notes']))
error($config['error']['noaccess']);
+ $_POST['note'] = escape_markup_modifiers($_POST['note']);
markup($_POST['note']);
$query = prepare('INSERT INTO `ip_notes` VALUES (NULL, :ip, :mod, :time, :body)');
$query->bindValue(':ip', $ip);
@@ -1214,12 +1217,14 @@ function mod_ban_post($board, $delete, $post, $token = false) {
if (isset($_POST['public_message'], $_POST['message'])) {
// public ban message
$length_english = parse_time($_POST['length']) ? 'for ' . until(parse_time($_POST['length'])) : 'permanently';
+ $_POST['message'] = preg_replace('/[\r\n]/', '', $_POST['message']);
$_POST['message'] = str_replace('%length%', $length_english, $_POST['message']);
$_POST['message'] = str_replace('%LENGTH%', strtoupper($length_english), $_POST['message']);
- $query = prepare(sprintf('UPDATE `posts_%s` SET `body` = CONCAT(`body`, :body) WHERE `id` = :id', $board));
+ $query = prepare(sprintf('UPDATE `posts_%s` SET `body_nomarkup` = CONCAT(`body_nomarkup`, :body_nomarkup) WHERE `id` = :id', $board));
$query->bindValue(':id', $post);
- $query->bindValue(':body', sprintf($config['mod']['ban_message'], utf8tohtml($_POST['message'])));
+ $query->bindValue(':body_nomarkup', sprintf('%s ', $_POST['message']));
$query->execute() or error(db_error($query));
+ rebuildPost($post);
modLog("Attached a public ban message to post #{$post}: " . utf8tohtml($_POST['message']));
buildThread($thread ? $thread : $post);
@@ -1713,6 +1718,7 @@ function mod_new_pm($username) {
}
if (isset($_POST['message'])) {
+ $_POST['message'] = escape_markup_modifiers($_POST['message']);
markup($_POST['message']);
$query = prepare("INSERT INTO `pms` VALUES (NULL, :me, :id, :message, :time, 1)");
diff --git a/post.php b/post.php
index f6cdcb00..42e2bfcc 100644
--- a/post.php
+++ b/post.php
@@ -108,7 +108,7 @@ if (isset($_POST['delete'])) {
if (count($report) > $config['report_limit'])
error($config['error']['toomanyreports']);
- $reason = &$_POST['reason'];
+ $reason = escape_markup_modifiers($_POST['reason']);
markup($reason);
foreach ($report as &$id) {
@@ -379,6 +379,11 @@ if (isset($_POST['delete'])) {
error(sprintf($config['error']['toolong'], 'password'));
wordfilters($post['body']);
+ $post['body'] = escape_markup_modifiers($post['body']);
+
+ if ($mod && isset($post['raw']) && $post['raw']) {
+ $post['body'] = '' . $post['body'] . ' ';
+ }
if (mysql_version() >= 50503) {
$post['body_nomarkup'] = $post['body']; // Assume we're using the utf8mb4 charset
@@ -397,8 +402,7 @@ if (isset($_POST['delete'])) {
}
}
- if (!($mod && isset($post['raw']) && $post['raw']))
- $post['tracked_cites'] = markup($post['body'], true);
+ $post['tracked_cites'] = markup($post['body'], true);
// Check for a flood
if (!hasPermission($config['mod']['flood'], $board['uri']) && checkFlood($post)) {
diff --git a/templates/page.html b/templates/page.html
index a7c6a300..0d33c16f 100644
--- a/templates/page.html
+++ b/templates/page.html
@@ -22,4 +22,4 @@
Powered by Tinyboard {{ config.version }} | Tinyboard Copyright © 2010-2013 Tinyboard Development Group