Uploaded image for project: 'phpBB3'
  1. phpBB3
  2. PHPBB3-8319

LOCAL_URL not enforced in bbcodes

    Details

    • Type: Bug
    • Status: Unverified Fix
    • Priority: Blocker
    • Resolution: Fixed
    • Affects Version/s: 3.0.4
    • Fix Version/s: 3.0.12-RC1
    • Component/s: Posting
    • Labels:
      None
    • Environment:
      PHP Environment:
      Database:

      Description

      When creating a custom bbcode, the description for LOCAL_URL says "The URL must be relative to the topic page and cannot contain a server name or protocol."
      This restriction is not enforced at all, any URL is accepted into the bbcode.

        Issue Links

          Activity

          Hide
          A_Jelly_Doughnut A_Jelly_Doughnut added a comment -

          This would seem to be a regression ... in 3.0.2 (I think) this worked fine.

          Show
          A_Jelly_Doughnut A_Jelly_Doughnut added a comment - This would seem to be a regression ... in 3.0.2 (I think) this worked fine.
          Hide
          ric323 ric323 added a comment -

          That's the same as 3.02, so the change must be elsewhere.
          (Note, I haven't verified that it DOES work in 3.0.2.)

          Show
          ric323 ric323 added a comment - That's the same as 3.02, so the change must be elsewhere. (Note, I haven't verified that it DOES work in 3.0.2.)
          Hide
          naderman Nils Adermann added a comment - - edited

          As I'm trying to work out how to fix this, here are some examples of LOCAL_URL usage in the wild:
          https://www.phpbb.com/community/viewtopic.php?p=13006267#p13006267
          https://www.phpbb.com/community/viewtopic.php?p=13012245#p13012245
          https://www.phpbb.com/community/viewtopic.php?p=13086909#p13086909
          https://www.phpbb.com/community/viewtopic.php?p=9584055#p9584055
          https://www.phpbb.com/community/viewtopic.php?p=8252965#p8252965

          (will be updating this comment as I find more)

          Based on this it seems like LOCAL_URL ended up being used for multiple purposes. One being a general pattern for paths used in any URL. And for actual local full URLs or paths expecting it to validate the server name.

          The real issue here is that a full URL is an absolutely valid path, e.g. there is nothing invalid about http://www.example.com/http://www.example.com - that's why the regex for matching paths which is used for this BBCode ends up matching any full URL as well. I believe the proper solution is to always expand the resulting replacement with the schema and the board's server name. However this will break existing BBCodes. Full URLs including the board's server name would not need the schema prepended.

          That leaves generic usage as a path as in my first example for a google maps URL. I'm not sure what to do about that one.

          Show
          naderman Nils Adermann added a comment - - edited As I'm trying to work out how to fix this, here are some examples of LOCAL_URL usage in the wild: https://www.phpbb.com/community/viewtopic.php?p=13006267#p13006267 https://www.phpbb.com/community/viewtopic.php?p=13012245#p13012245 https://www.phpbb.com/community/viewtopic.php?p=13086909#p13086909 https://www.phpbb.com/community/viewtopic.php?p=9584055#p9584055 https://www.phpbb.com/community/viewtopic.php?p=8252965#p8252965 (will be updating this comment as I find more) Based on this it seems like LOCAL_URL ended up being used for multiple purposes. One being a general pattern for paths used in any URL. And for actual local full URLs or paths expecting it to validate the server name. The real issue here is that a full URL is an absolutely valid path, e.g. there is nothing invalid about http://www.example.com/http://www.example.com - that's why the regex for matching paths which is used for this BBCode ends up matching any full URL as well. I believe the proper solution is to always expand the resulting replacement with the schema and the board's server name. However this will break existing BBCodes. Full URLs including the board's server name would not need the schema prepended. That leaves generic usage as a path as in my first example for a google maps URL. I'm not sure what to do about that one.
          Hide
          nickvergessen Joas Schilling added a comment -

          We could add BOARD_LOCAL_URL and prepend it with the data you suggested and advice using that when suitable and keep LOCAL_URL as is.
          Although we could also use LOCAL_URL and break all existing BBCodes:

          A local URL. The URL must be relative to the topic page and cannot contain a server name or protocol.

          An Admin can then change it to the new RELATIVE_URL, when ever it's needed.
          Advance here is that stuff is broken for security reason and can be fixed within 1 minute (could also be notified while updating the board to check it). Rather then leaving everything and hope that the admin will check the BBCode acp anytime soon...

          Show
          nickvergessen Joas Schilling added a comment - We could add BOARD_LOCAL_URL and prepend it with the data you suggested and advice using that when suitable and keep LOCAL_URL as is. Although we could also use LOCAL_URL and break all existing BBCodes: A local URL. The URL must be relative to the topic page and cannot contain a server name or protocol. An Admin can then change it to the new RELATIVE_URL, when ever it's needed. Advance here is that stuff is broken for security reason and can be fixed within 1 minute (could also be notified while updating the board to check it). Rather then leaving everything and hope that the admin will check the BBCode acp anytime soon...

            People

            • Assignee:
              nickvergessen Joas Schilling
              Reporter:
              ric323 ric323
            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Development