[RSS Feed/News] \XF\BbCode\Renderer\Html::renderTagTable corrupts tables on edit

Status
Not open for further replies.

XenForo

Administrative
  • Thread starter
  • Admin
  • #1
XenForo 2.2.9

\XF\BbCode\Renderer\Html::renderTagTable, line 1620:
PHP:

$rows[$i] = preg_replace('#</tr>$#', "$filler\0", $rows[$i]);
The backslash in the replacement text isn't escaped, so it results in a literal null byte instead of </tr>.

This causes unexpected behavior with certain malformed BB code tables that a confused user could accidentally create, such as:
Code:

Code:
[table]
[tr][td]a1[/td][td]b1[/td][/tr]
[tr][td]a2[/td][td]b2
[tr][td]a3[/td][td]b3[/td][/tr]
[/td][/tr][/table]

Repro:
  1. ...

Read more

ادامه مطلب...
 
Status
Not open for further replies.
Back
Top Bottom