BBCode [CODE]c source code[/CODE]

[flohse]

When using HTML On in a post you will get strange behaviour for the following code tag

// Header file for input output functions
#include <stdio.h>

// Main function: entry point for execution
int main() {

    // Writing print statement to print hello world
    printf("Hello World");

    return 0;
}

In my case only this is shown:



So "<stdio.h>" is missing, although it is still there. This cannot be reproduced here on vbmods.rock since HTML On is not allowed for regular users.

It seems that vBulletin interpretes HTML also inside the code tag, what shouldn't happen in my opinion.

Any suggestions or comments?

[glennrocksvb]

Try this temporary solution while waiting for the official fix by vBulletin. The solution requires editing existing PHP file, which means you'll have to re-apply this after every forum upgrade as it'll get overwritten.

Add this line in <vB root directory>/includes/vb5/template/bbcode.php:

// Escape < to &lt; to prevent it from being treated as HTML
$code = str_replace('<', '&lt;', $code);​ 

Locate the handle_bbcode_code function and add the above code right below this line:

$code = str_replace(['<br>', '<br />'], ['', ''], $code); 

Final result:

$code = str_replace(['<br>', '<br />'], ['', ''], $code);

// Escape < to &lt; to prevent it from being treated as HTML
$code = str_replace('<', '&lt;', $code);​ 

[flohse]

I have asked this on vbulletin.com and got the following answer from Wayne Luke.

The system is processing the unknown HTML of <stdio.h> and the browser is processing it as HTML. vBulletin isn't altering the code. It seems that the definition in of the <pre> tag changed along the way so that code can be interpreted inside it. No C code is being interpreted or processed. The only workaround that I have at this time is to replace < and > with &lt; and &gt; respectively.

Though, I also consider this a bug and the system should perform these replacements automatically if HTML is enabled.

I also kindly asked him to bring this to their bugtracker.

[glennrocksvb]

I'm posting this while HTML is on.

// Header file for input output functions
#include 

// Main function: entry point for execution
int main() {

    // Writing print statement to print hello world
    printf("Hello World");

    return 0;
}

[glennrocksvb]

Try this temporary solution while waiting for the official fix by vBulletin. The solution requires editing existing PHP file, which means you'll have to re-apply this after every forum upgrade as it'll get overwritten.

Add this line in <vB root directory>/includes/vb5/template/bbcode.php:

// Escape < to &lt; to prevent it from being treated as HTML
$code = str_replace('<', '&lt;', $code);​ 

Locate the handle_bbcode_code function and add the above code right below this line:

$code = str_replace(['<br>', '<br />'], ['', ''], $code); 

Final result:

$code = str_replace(['<br>', '<br />'], ['', ''], $code);

// Escape < to &lt; to prevent it from being treated as HTML
$code = str_replace('<', '&lt;', $code);​ 

[flohse]

I also needed to replace the closing mark as well to make this finally work.

change function handle_bbcode_code in includes/vb5/template/bbcode.php

from

        function handle_bbcode_code($code)
        {
                // remove unnecessary line breaks and escaped quotes
                $code = str_replace(['<br>', '<br />'], ['', ''], $code);

                $code = $this->stripFrontBackWhitespace($code, 1);
​ 

to

        function handle_bbcode_code($code)
        {
                // remove unnecessary line breaks and escaped quotes
                $code = str_replace(['<br>', '<br />'], ['', ''], $code);

                // Escape < to &lt; to prevent it from being treated as HTML
                $code = str_replace('<', '&lt;', $code);
                
                // Escape > to &gt; to prevent it from being treated as HTML
                $code = str_replace('>', '&gt;', $code);

                $code = $this->stripFrontBackWhitespace($code, 1);
​ 

[glennrocksvb]

You could but you don't have to. Replacing just the < should prevent it from rendering as HTML tag. Having &lt; div> will not render as <div>

[flohse]

You're right. I don't know, I can't reproduce it anymore.