after update to 2.1 > comments '<'.removeEvilAttributes('b

[EGYPT]

hello phpM Team
i noticed that after updating my website from v2.0.1 to v2.1
my comments system allow to anyone and i use blacklist function ,
every comment from visitors .. after submit comment , write automatically '<'.removeEvilAttributes('br /').'>'
screen shot

thanks in advance

[ciberlinker]

I have the same problem..

[muzikia]

Change the comment system to the disqus. no more spam or other issues I've seen here and unsolved.
Here it is a tutorial: http://www.modmyscript.com/add-disqus-o ... elody-2-x/

[ciberlinker]

Change the comment system to the disqus. no more spam or other issues I've seen here and unsolved.
Here it is a tutorial: http://www.modmyscript.com/add-disqus-o ... elody-2-x/

Muzikia the problem is not only in the comments ..

a greeting

[muzikia]

check it here
viewtopic.php?p=60530&f=6#p60530

[Trace]

Solution
In /include/functions.php FIND

Code: Select all

function removeEvilTags($source)
{
   global $allowedTags;
   $source = RemoveCurseWords(strip_tags($source, $allowedTags));
   return preg_replace('/<(.*?)>/ie', "'<'.removeEvilAttributes('\\1').'>'", $source);
}

REPLACE WITH

Code: Select all

function removeEvilTags($source)
{
   global $allowedTags;
   $source = RemoveCurseWords(strip_tags($source, $allowedTags));
   return preg_replace_callback('/<(.*?)>/i', 'removeTagAttributes', $source);
}
function removeTagAttributes($in){
   return '<'.removeEvilAttributes($in).'>';
}

Note: this will only fix new comments, the ones that are broken will remain broken

[ciberlinker]

Thanks Trace

[adysnake]

Thanks Trace !!

[mephisto]

Thanks Trace, been upgrading my old phpmelody 1.6.x to php 7.2 and this was one of the remaining issues.