Hi,

its a tradition in Drupal to warn users about the risk of giving the ability of using php (filters). On a test site I have installed BBcode for test. I have noticed that with BBCode, users can use a [php] tag.

1) is there a risk related to this possibility?
2) is it possible to restrict the tags members can use?

In my case, I essentially want my users to be able to insert remote images [img] [/img] on the forum.

Thank your for your time.

Comments

StudioARE’s picture

StudioARE commented

You almost had me worried as well, but the php tag is only for styling code with color. :)

Referring to the filter tips:

You can use the [code] tag to add an inline fixed-width formatted part or to add a block of (usually program) code. If there is any newline present between the opening and closing tags, then a block will be displayed.

Similarly, the [php] tag can be used to post PHP code. PHP code will automatically be syntax highlighted for easier readability.

As for your second note, I haven't seen any restrictions for what BBCode tags users can make use of. Sadly enough. Sounds like an exciting feature request though!

-Are

Québec’s picture

Québec commented

Hi,

Sorry for the «false alert»! But I was not shure of the possible risk of this php tag used by members inside a node.

BBcode will be added to my not-yet-perfect community! (www.hangar217.com)

Thanks for your time!

R.

naudefj’s picture

naudefj commented
Issue summary: View changes
Status: Active » Closed (cannot reproduce)

Look at the test suite included with the module, where it deliberately tries to break a site and inject bad code, all without luck.
No code is 100% fool proof, but this module is pretty close.