XenForo
Administrative
- Thread starter
- Admin
- #1
XenForo 2.2.9
\XF\BbCode\Renderer\Html::renderTagTable, line 1620:
PHP:
The backslash in the replacement text isn't escaped, so it results in a literal null byte instead of
This causes unexpected behavior with certain malformed BB code tables that a confused user could accidentally create, such as:
Code:
Repro:
Read more
ادامه مطلب...
\XF\BbCode\Renderer\Html::renderTagTable, line 1620:
PHP:
$rows[$i] = preg_replace('#</tr>$#', "$filler\0", $rows[$i]);
The backslash in the replacement text isn't escaped, so it results in a literal null byte instead of
</tr>
.This causes unexpected behavior with certain malformed BB code tables that a confused user could accidentally create, such as:
Code:
Code:
[table]
[tr][td]a1[/td][td]b1[/td][/tr]
[tr][td]a2[/td][td]b2
[tr][td]a3[/td][td]b3[/td][/tr]
[/td][/tr][/table]
Repro:
- ...
Read more
ادامه مطلب...