IMG and URL security

IMG and URL security

Mod Version: 1.00, by bosal

This modification is in the archives.

vB Version: 3.6.7	Rating: (2 votes - 4.50 average)	Installs: 6
Released: 22 Feb 2007	Last Update: Never	Downloads: 2
Not Supported Code Changes

This is a so called "hack". I wanted that my users with IE web browser don't get "IE explit" in IMG tags.

My problem was bigger, becouse I couldn't disable IMG tags, and teach users to use FF.

This hack is just a little file integrated addon. It works to IMG tags, and URL tags just fine.

Install

So, backup file: yoursite.com/forum/includes/class_bbcode.php. When you have a safty cope, you can begin with editing the file.

In class_bbcode.php find:

URL hack

Code:

	* Handles a [url] tag. Creates a link to another web page.

then scroll down till you see:

Code:

		// remove double spaces -- fixes issues with wordwrap
		$rightlink = str_replace('  ', '', $rightlink);
		// standard URL hyperlink
		return "<a href=\"$rightlink\" target=\"_blank\">$text</a>";

now you must replce the this code with:

Code:

		// remove double spaces -- fixes issues with wordwrap
		$rightlink = str_replace('  ', '', $rightlink);
		// URL hack
		if ( preg_match("#^http://([a-z0-9\-_\.]*)goodsite\.com/?(/(.*))?$#i" ,"$rightlink") 		){
		return "<a href=\"$rightlink\" target=\"_blank\">$text</a>"; 
		}
		else if ( preg_match("#^http://([a-z0-9\-_\.]*)goodsite2\.com/?(/(.*))?$#i" ,"$rightlink") ){
		return "<a href=\"$rightlink\" target=\"_blank\">$text</a>"; 
		else {
		return "<a href=\"$rightlink\" target=\"_blank\">$text</a> <strong>[Warning, this link can be a Virus link]</strong>"; 
}

Just replace the goodsite\.com with the site you know it's secure. Eg. yoursite

What it do ?

When posting, an URL like: goodsite.com it shows like http://goodsite.com
It works on: enything.etc.goodsite.com/enything, in all ways.
When you post a site like: hacksite.com it shows like http://hacksite.com [Warning, this link can be a Virus link]

Ok the second part is with a IMG tag, it's the same way. When you post a secure Image the image just shows, but when you post a Image, that isn't in the if () else () script, it shows only a link and a warning. I show this example with imageshac.us that is secure to me

IMG hack

In the same file find:

Code:

	* Handles a match of the [img] tag that will be displayed as an actual image.

Scroll down, and select:

Code:

		// remove double spaces -- fixes issues with wordwrap
		$link = str_replace('  ', '', $link);
		return '<img src="' .  $link . '" border="0" alt="" />';

replace it with:

Code:

		// remove double spaces -- fixes issues with wordwrap
		$link = str_replace('  ', '', $link);
		if ( preg_match("#^http://([a-z0-9\-_\.]*)imageshack\.us/?(/(.*))?$#i" ,"$link") ){
		return '<img src="' .  $link . '" border="0" alt="" />';
		}
		else if ( preg_match("#^http://([a-z0-9\-_\.]*)photobucket\.com/?(/(.*))?$#i" ,"$link") ){
		return '<img src="' .  $link . '" border="0" alt="" />';
		}
		else {
		return "<a href=\"$link\" target=\"_blank\">$link</a> <strong>[Warning, this link can be a Virus link]</strong>"; 
		}

Thats all, comments plax :P

Download

No files for download.

vBulletin LTS