HTML appearing in reviews?

bob weaver · March 24th, 2008, 12:54 AM

An unregistered user is posting reviews that look like they contain HTML. For example, someone added a review that contains an <A HREF statement as well as URLs. You can see the example by looking at the reviews for this product:

http://fireworksland.com/ultimate/sh...p?product=6311

In my Admin Options, "Allow HTML in Product Fields?" is set to No.
and "Allow HTML in Reviews?" is also set to No.

How is this user able to add reviews that contain <A HREF code, and what can I do about it? Is there another option that needs to be changed?
Thank you

TheSonic · March 24th, 2008, 05:34 AM

I have this problem since i use vb 3.7 (beta, now RC).

Most of the time this happens on my board is, then users use the WYSIWYG-Editor.

PhotoPost was fixed, as far as i know (after last PhotoPost-Update, it never happend on PhotoPost) Perhaps Chuck can provide us a little fix ;-)

EDIT: Sorry Bob, after watching you Site, i saw you don't use vBulletin.

@Chuck or Michael: Can you please have a look in vB's WYSIWYG-Editor-integration? THANKS!

Chuck S · March 24th, 2008, 09:20 AM

Actually he is not posting html he is posting bbcode it looks like and that is allowed if html is off.

There is nothing you can do about that except remove the line in showproduct.php to convert_markups for the review.

bob weaver · March 24th, 2008, 10:22 AM

OK thanks.

Chuck S · March 24th, 2008, 01:21 PM

yeah thats what it looks like as you have 3 valid links converted from an img tag and then you see the unprocessed link statement as thats not a valid bbcode that we process it looks like that is just printed in the comment.

TheSonic · March 24th, 2008, 07:22 PM

What about the WYSIWYG-Editor from vBulletin? Any fiy on the horizont

Thanks!

Chuck S · March 24th, 2008, 10:50 PM

You can look forward to a reviewpost beta shortly and try it when I release one. I am not sure what changes your referring to but something we can look at in the beta cycle.

TheSonic · March 25th, 2008, 09:52 AM

Ok, thanks.. So i'll wait for RP-Beta (perhaps vB is gold at this time, so i am sure we will figure it out and fix it

)

Chuck S · March 25th, 2008, 10:21 AM

Not a problem have a good one.

TheSonic · April 15th, 2008, 05:00 PM

Are there news about the RP-Beta? I still have the problem with the appearing HTML-Code (vb @ 3.7 RC3)

Thanks ! :-)

Chuck S · April 15th, 2008, 07:47 PM

the only example posted in this thread the guy is using bbcode not html so i am not sure what your referring to but anyway a beta should be out shortly support is keeping me tied up some here and I had expected to have released in a couple weeks ago.

TheSonic · April 27th, 2008, 09:00 AM

Have a look:
http://www.stuttgart-fans.de/bewertu...hp?product=543

You will find HTML-Code from users who use the WYSIWYG-Editor in vBulletin.
This only happens since i upgraded vBulletin to 3.7 (always actual Beta or RC)

Thanks

Chuck S · April 27th, 2008, 11:51 AM

Okay I dont see anything wrong with that through its html and I am sure you can do the same thing in vb but you need to throw the switch in vb to allow the html to show. We have pretty much the same thing in reviewpost its the admin switches allow html in reviews or allow html in products depending on where it is.

Its always been this way and is not just a vb 3.7 thing that I am aware of.

Also 3.7 is still a beta or RC as I see. There latest gold code is 3.6.10

TheSonic · April 28th, 2008, 03:29 AM

I disabled HTML in vBulletin (you are right, it's there since i use vB a long
time ago :-) ) and both switches in ReviwPost:

Allow HTML in Product Fields?
Please note it is a security issue to allow html in product fields but if you do want to take the risk set to YES!

Allow HTML in Reviews?
Please note it is a security issue to allow html in reviews!

are set to NO.

Like i said, it never was a problem before 3.7 and it only appears then using the WYSIWYG-Editor.

vB is on RC4 and will be Gold this week.

Chuck S · April 28th, 2008, 06:31 AM

You have always been able to type html in a product description or review in photopost products we do not parse the html though. In Reviewpost we added the ability to parse the html. Now if you wish to strip html from a review you can remove tags you wish to allow in the un_htmlspecialchars function at the top of pp-inc.php thats all I can tell ya as this would not be an issue with vb or really an issue. I could type paragraph tags in any version of vb. I have vb 3.6 and can type a review like that with ease using html in the review.

TheSonic · April 29th, 2008, 03:55 AM

Hm, when i use the WYSIWYG-Editor, it adds the HTML-Code automatically after submitting (not during typing), so users add HTML-Code without their knowledge (eg. Linebreak, etc.)

It would be noe problem, if they type HTML-Code by themself, but they just type in the WYSIWYG-Editor and end up with HTML-Code.

If they do NOT use the WYSIWYG-Editor, eveything is fine (but thats not really an option

)

Thanks for looking...

Chuck S · April 29th, 2008, 10:34 AM

I was not talking about line breaks only thing I see on your example is people typing paragraph tags but at any rate i will look at their beta.

TheSonic · April 29th, 2008, 10:41 AM

They just typing reviews and end up with HTML-Code

I am happy if you would have a look.... vB is now 3.7 Gold.

Please let me know if i can assist you.

Thanks.

Chuck S · April 29th, 2008, 10:46 AM

yeah well i will have to wait for my vb renewal.

TheSonic · May 13th, 2008, 06:47 PM

Was ReviePost cancled or will customers receive support soon?

I need to know, because i will remove ReviewPost from my page if there is no support - and i am waiting for MONTHS now