PHP-Nuke: Management and Programming
Prev Chapter 16. Modifying mainfile.php Next

16.1. How to allow special HTML tags

User input is checked and filtered automatically by PHP-Nuke. For this purpose the functions filter_text and check_html are used. filter_text checks and replaces bad words, then calls check_html, which in turn checks for HTML tags and strips them completely off, if the second parameter is "nohtml".

Table 16-1 shows all modules that call filter_text, together with the line the call is made on. You can see that filter_text is used to filter

  • the text of a mail response in the WebMail module

  • the comments in the News module

  • the comments in the Reviews module

  • the subject, story and extended story text in the Submit_News module

  • the subject and comments in the Surveys module

  • the username and message in the Your_Account module

Table 16-1. Calls to filter_text from PHP-Nuke modules (v.6.8)

Module

Line with call to filter_text

modules/WebMail/readmail.php

$res = filter_text($res); // Security fix by Ulf Harnhammar 2002

modules/News/comments.php

$comment = FixQuotes(nl2br(filter_text($comment)));

modules/News/comments.php

$subject = FixQuotes(filter_text($subject, "nohtml"));

modules/News/comments.php

$comment = FixQuotes(filter_text($comment));

modules/Reviews/index.php

$comments = FixQuotes(nl2br(filter_text($comments)));

modules/Submit_News/index.php

$subject = FixQuotes(filter_text($subject, "nohtml"));

modules/Submit_News/index.php

$story = FixQuotes(nl2br(filter_text($story)));

modules/Submit_News/index.php

$storyext = FixQuotes(nl2br(filter_text($storyext)));

modules/Submit_News/index.php

$story = FixQuotes(filter_text($story));

modules/Submit_News/index.php

$storyext = FixQuotes(filter_text($storyext));

modules/Surveys/comments.php

$subject = FixQuotes(filter_text($subject, "nohtml"));

modules/Surveys/comments.php

$comment = FixQuotes(nl2br(filter_text($comment)));

modules/Surveys/comments.php

$comment = FixQuotes(filter_text($comment));

modules/Your_Account/index.php

filter_text($username);

modules/Your_Account/index.php

if ($bio) { filter_text($bio); $bio = $EditedMessage; $bio = FixQuotes($bio); }

modules/Your_Account/index.php

$the_message = FixQuotes(filter_text($the_message, "nohtml"));


check_html, in turn, is not only called from filter_text, but also in its own right. Table 16-2 shows all modules that call check_html and the line it is called on. You can see that check_html is called to check the HTML input in

  • the query string in the Downloads, Encyclopedia, Web Links and Search sections

  • the title, text, reviewer, URL text and comments in the Reviews module

  • user name, e-mail, various user info fields in the Your Account module

  • bodytext and comments in the Journal module

Table 16-2. Calls to check_html from PHP-Nuke modules (v.6.8)

Module

Line with call to filter_text

modules/Downloads/index.php

$query = check_html($query, nohtml);

modules/Encyclopedia/search.php

$query = check_html($query, nohtml);

modules/Encyclopedia/search.php

$query = check_html($query, nohtml);

modules/Reviews/index.php

$title = stripslashes(check_html($title, "nohtml"));

modules/Reviews/index.php

$text = stripslashes(check_html($text, ""));

modules/Reviews/index.php

$reviewer = stripslashes(check_html($reviewer, "nohtml"));

modules/Reviews/index.php

$url_title = stripslashes(check_html($url_title, "nohtml"));

modules/Reviews/index.php

$title = stripslashes(FixQuotes(check_html($title, "nohtml")));

modules/Reviews/index.php

$text = stripslashes(Fixquotes(urldecode(check_html($text, ""))));

modules/Reviews/index.php

$comments = stripslashes(FixQuotes(check_html($comments)));

modules/Search/index.php

$query = stripslashes(check_html($query, nohtml));

modules/Web_Links/index.php

$query = check_html($query, nohtml);

modules/Your_Account/index.php

$username = check_html($username, nohtml);

modules/Your_Account/index.php

$user_email = check_html($user_email, nohtml);

modules/Your_Account/index.php

$user_email = check_html($user_email, nohtml);

modules/Your_Account/index.php

$femail = check_html($femail, nohtml);

modules/Your_Account/index.php

$user_website = check_html($user_website, nohtml);

modules/Your_Account/index.php

$bio = check_html($bio, nohtml);

modules/Your_Account/index.php

$user_avatar = check_html($user_avatar, nohtml);

modules/Your_Account/index.php

$user_icq = check_html($user_icq, nohtml);

modules/Your_Account/index.php

$user_aim = check_html($user_aim, nohtml);

modules/Your_Account/index.php

$user_yim = check_html($user_yim, nohtml);

modules/Your_Account/index.php

$user_msnm = check_html($user_msnm, nohtml);

modules/Your_Account/index.php

$user_occ = check_html($user_occ, nohtml);

modules/Your_Account/index.php

$user_from = check_html($user_from, nohtml);

modules/Your_Account/index.php

$user_interests = check_html($user_interests, nohtml);

modules/Your_Account/index.php

$realname = check_html($realname, nohtml);

modules/Journal/display.php

$row[bodytext]=check_html($row[bodytext], $strip);

modules/Journal/display.php

$row[comment]=check_html($row[comment], $strip);


check_html uses the $AllowableHTML array that is defined in config.php. The idea is that only the tags that are included in the $AllowableHTML array should be allowed. However, even if you explicitly allow the img tag in $AllowableHTML, it will be stripped away by check_html (and by filter_text, which also calls it). The line that does this is

$str = eregi_replace("<[[:space:]]* img[[:space:]]*([^>]*)[[:space:]]*>", ", $str);

You can comment out that line - though it is certainly a security issue (allowing people to post harmful code in img tags).

You can also comment out the line that eliminates all anchor attributes exept href in the <a> tag:

$str = eregi_replace("<a[^>]*href[[:space:]]*=[[:space:]]*"?[[:space:]]*([^" >]*)[[:space:]]*"?[^>]*>", '<a href="">', $str); # "

These changes will affect the checks done at all places shown in both Table 16-1 and Table 16-2, so again, be careful with security issues. You have to trust your users to give them this comfort.

Put the tags you want to allow in the $AllowableHTML array in the config.php file. Here is a (quite liberal) example:

$AllowableHTML = array("b"=>1,
         "i"=>1,
         "a"=>2,
         "em"=>1,
         "br"=>1,
         "strong"=>1,
         "blockquote"=>1,
         "tt"=>1,
         "li"=>1,
         "ol"=>1,
         "H1"=>1,
         "H2"=>1,
         "H3"=>1,
         "H4"=>1,
         "center"=>1,
         "img"=>2,
         "alt"=>1,
         "table"=>2,
         "tr"=>2,
         "td"=>2,
         "p"=>2,
         "div"=>2,
         "font"=>2,
         "p"=>1,
         "p"=>1,
         "ul"=>1);

The numbers that appear next to each tag have the following meaning:

  • a 1 means the tag does not accept any attributes

  • a 2 indicates that the tag may also contain attributes

See also Section 3.7.

Prev Home Next
Modifying mainfile.php Up How to change the order of messages

PHP-Nuke Documentation module made by Chris Karakas
Karakas Online Spaghettibrain