Use of < img src not working inside profile fields in 2.3.2?

[Alien]

Howdy folks.

I use a shortcut to give users special icons such as being a financial contributor. It worked perfectly for many versions, but since the 2.3.0 to 2.3.2 upgrade it no longer functions.

1) I create a User Profile Field in the Admin CP, for example "Contributor".

2) Then I edit a user and go to the Contributor field and put a proper < img src call to an icon.

3) Then I call that profile field inside of the postbit, using:

$post[field11] for example...

In step 2, after filling it out the image doesn't show properly, if you re-edit the user you will see the field incomplete and an odd > bracket symbol right AFTER the textfield.

This did not occur in 2.3.0, and this is my ONLY issue in my entire upgrade, can anyone else confirm this?

[Alien]

Can anyone confirm this?

[Alien]

Waiting patiently.

[Guest]

Try entering the url in the custom feild and doing it like this in the template:

<img src="$post[field11]" />

Just a work around, not sure why its doing that. IIRC customfeilds should be able to have html in them.

BTW I love your site, dont I remember you from somwhere?. Ubbdev?

[Alien]

Hey.

Yes, I was very active on ubbdev for quite a while (and was the first winner of the 'member spotlight' award), then I just fell in love with vB 2 years ago and it's heaven every since... Ahh, the old days! ...and thank you very much for the kind words... I very much appreciate them from those of your caliber!

I'll try that workaround today and see if that goes through, it's a great idea...

Regards,
-Jason

[Alien]

One thought about the workaround, is that if someone doesn't have a field filled out it will still load the < img src and come up with an empty image or something equally as ugly, no? Or am I looking at this wrong?

Regards,
-Jason

[Guest]

In version two yes, altho a *small* hack will *fix* the problem very easyly, check out the postbit functions in /admin/functions.php.

In vB 3 you could control it via the <if> tags.

Anyway, ill send you a pm as the 'hack' is rather small.

BTW I was very active at ubbdev to, wrote the rpg stats for 6.05 .

[rfonseca]

Ugh! Same problem here. Everytime I or a user alters anything in their profile the html gets changed.

eg - < gets changed to &lt;

[Alien]

Perhaps he can send you the code to help out, I'm going to give it a try later tonight...

Wonder what happened to change things from the old way, in 2.3.2..

[Alien]

Okay before I try this.. If this ability was somehow removed from 2.3.2, I'd just like to confirm why.. I don't want to introduce this feature again by bringing in a possible security hole... Will your modification open anything negative up?

Regards,
-Jason

[Freddie Bingham]

Anytime a user saves a profile field, the data is sent through htmlspecialchars which converts < to &lt;, among other things. That is the way it has always worked.

[rfonseca]

Anytime a user saves a profile field, the data is sent through htmlspecialchars which converts < to &lt;, among other things. That is the way it has always worked.

hmm... that didn't happen before the last upgrade. The code stayed intact. When I look at a user in the admin this is what I see:

[Alien]

freddie: We're referring to when an admin in the admin CP adds html code into a field, such as a "Contributor" field that the user cannot modify.


Something like < img src=http://www.sitename.com/contrib_icon.gif border="0" alt="This user is a contributing member!" >

When doing this, and calling the proper field within the postbit, it is now a 'big red x' image.

It always displayed properly in the admin cp when you would go back in to edit the user or give him another award. Now it will not. Html is now stripped in the profile fields there too, and it never worked that way before.

It's worked for me for over a year I've done it that way. Now since going from 2.3.0 to 2.3.2 it will not.

-Jason

[Guest]

Okay before I try this.. If this ability was somehow removed from 2.3.2, I'd just like to confirm why.. I don't want to introduce this feature again by bringing in a possible security hole... Will your modification open anything negative up?

Regards,
-Jason

Simple modification, worked as long as vB had posts set up that way for me. , ive used it for other things tho.

[Freddie Bingham]

Hmm if I look at profilefield.php, the last change to it was made just before 2.3.2/2.3.1 and was Kier simply changing & to amp; for the links. Before that the last change was made 2 years ago by me.

I'll see if I can duplicate you are getting at. Perhaps something was changed in adminfunctions.php.