Browse Source

Prevent raw HTML editing a post with tinyboard modifiers (e.g. user flags) from inserting them into the visible post body

main
discomrade 2 years ago
parent
commit
321c742124
  1. 19
      inc/mod/pages.php

19
inc/mod/pages.php

@ -2066,12 +2066,6 @@ function mod_edit_post($board, $edit_raw_html, $postID) {
// Remove any modifiers they may have put in
$_POST['body'] = remove_modifiers($_POST['body']);
// Add back modifiers in the original post
$modifiers = extract_modifiers($post['body_nomarkup']);
foreach ($modifiers as $key => $value) {
$_POST['body'] .= "<tinyboard $key>$value</tinyboard>";
}
if ($edit_raw_html)
$query = prepare(sprintf('UPDATE ``posts_%s`` SET `name` = :name, `email` = :email, `subject` = :subject, `body` = :body, `body_nomarkup` = :body_nomarkup WHERE `id` = :id', $board));
else
@ -2080,11 +2074,22 @@ function mod_edit_post($board, $edit_raw_html, $postID) {
$query->bindValue(':name', $_POST['name']);
$query->bindValue(':email', $_POST['email']);
$query->bindValue(':subject', $_POST['subject']);
$query->bindValue(':body', $_POST['body']);
if ($edit_raw_html) {
$body_nomarkup = $_POST['body'] . "\n<tinyboard raw html>1</tinyboard>";
// Add back modifiers in the original post
$modifiers = extract_modifiers($post['body_nomarkup']);
foreach ($modifiers as $key => $value) {
$body_nomarkup .= "<tinyboard $key>$value</tinyboard>";
}
$query->bindValue(':body_nomarkup', $body_nomarkup);
} else {
// Add back modifiers in the original post
$modifiers = extract_modifiers($post['body_nomarkup']);
foreach ($modifiers as $key => $value) {
$_POST['body'] .= "<tinyboard $key>$value</tinyboard>";
}
}
$query->bindValue(':body', $_POST['body']);
$query->execute() or error(db_error($query));
if ($edit_raw_html) {

Loading…
Cancel
Save