bbcode exploit

[Matchstick]

At my forum, I block images in signatures, but a user has discovered a work-around that I'm not sure whether I can fix without coding. The user uses the url tag with a jpg target (i.e. url=http://www.yaddayadda.com/image.jpg) which gets around the blocking of the img tag. I looked through the various sections of the AdminCP, but couldn't find any recourse. Is there any way to deal with this without modifying the vbulletin code that deals with the hard-coded tags? Thanks for any help.

[Paul M]

How about deleting the link and warning them not to do it again ?

Code is not always the solution.

[Colin F]

What code is he using exactly?

I can't reproduce this...

[feldon23]

You're telling me that they did [url]http://www.yaddayadda.com/image.jpg[/url] and the image was displayed? That would be a substantial bug and should be reported.

If you are upset that they can post a link to an image, well that's how the URL tag works. I suppose you could write some code that won't accept a URL that ends in JPG but they will always find ways around it.

[Matchstick]

*sigh* Closer examination of the situation reveals that I misread what was going on. The user had code like what feldon mentioned in his sig, but he'd also managed to upload a sig image that pointed at the same place, so I thought the link was what was leaking. Terribly sorry for the run-around, folks.