I wanted to be able to allow administrators to use HTML in their posts if they wanted, but no one else (since its my understanding that allowing HTML can be a greater security risk than not allowing HTML). To that end, I've made the following changes on my board and was wondering if someone could check them for me to see if I'm screwing anything else up or if this should work the way I want it to work (also please see below after the changes for three additional notes regarding these changes):
Please Note: This mod was developed for phpBB 2.0.4
Code: Select all
#
#-----[ OPEN ]------------------------------------------
#
posting.php
#
#-----[ FIND ]------------------------------------------
#
if ( !$board_config['allow_html'] )
{
$html_on = 0;
}
else
{
$html_on = ( $submit || $refresh ) ? ( ( !empty($HTTP_POST_VARS['disable_html']) ) ? 0 : TRUE ) : ( ( $userdata['user_id'] == ANONYMOUS ) ? $board_config['allow_html'] : $userdata['user_allowhtml'] );
}
#
#-----[ REPLACE WITH ]------------------------------------------
#
if ( !$board_config['allow_html'] )
{
$html_on = 0;
}
else
{
if ($userdata['user_level'] == ADMIN) {
$html_on = ( $submit || $refresh ) ? ( ( !empty($HTTP_POST_VARS['disable_html']) ) ? 0 : TRUE ) : ( ( $userdata['user_id'] == ANONYMOUS ) ? $board_config['allow_html'] : $userdata['user_allowhtml'] );
}
else
{
$html_on = 0;
}
}
#
#-----[ FIND ]------------------------------------------
#
if ( $board_config['allow_html'] )
#
#-----[ REPLACE WITH ]------------------------------------------
#
if ( $board_config['allow_html'] && $userdata['user_level'] == ADMIN)
#
#-----[ OPEN ]------------------------------------------
#
privmsg.php
#
#-----[ FIND ]------------------------------------------
#
if ( !$board_config['allow_html'] )
{
$html_on = 0;
}
else
{
$html_on = ( $submit || $refresh ) ? ( ( !empty($HTTP_POST_VARS['disable_html']) ) ? 0 : TRUE ) : $userdata['user_allowhtml'];
}
#
#-----[ REPLACE WITH ]------------------------------------------
#
if ( !$board_config['allow_html'] )
{
$html_on = 0;
}
else
{
if ($userdata['user_level'] == ADMIN) {
$html_on = ( $submit || $refresh ) ? ( ( !empty($HTTP_POST_VARS['disable_html']) ) ? 0 : TRUE ) : $userdata['user_allowhtml'];
}
else
{
$html_on = 0;
}
}
#
#-----[ FIND ]------------------------------------------
#
if ( $board_config['allow_html'] )
#
#-----[ REPLACE WITH ]------------------------------------------
#
if ( $board_config['allow_html'] && $userdata['user_level'] == ADMIN)
#
#-----[ OPEN ]------------------------------------------
#
templates/subSilver/profile_add_body.tpl
#
#-----[ FIND ]------------------------------------------
#
<tr>
<td class="row1"><span class="gen">{L_ALWAYS_ALLOW_HTML}:</span></td>
<td class="row2">
<input type="radio" name="allowhtml" value="1" {ALWAYS_ALLOW_HTML_YES} />
<span class="gen">{L_YES}</span>
<input type="radio" name="allowhtml" value="0" {ALWAYS_ALLOW_HTML_NO} />
<span class="gen">{L_NO}</span></td>
</tr>
#
#-----[ REPLACE WITH ]------------------------------------------
#
<!-- <tr>
<td class="row1"><span class="gen">{L_ALWAYS_ALLOW_HTML}:</span></td>
<td class="row2">
<input type="radio" name="allowhtml" value="1" {ALWAYS_ALLOW_HTML_YES} />
<span class="gen">{L_YES}</span>
<input type="radio" name="allowhtml" value="0" {ALWAYS_ALLOW_HTML_NO} />
<span class="gen">{L_NO}</span></td>
</tr>-->
#
#-----[ SAVE & CLOSE ALL FILES ]--------------------------
#
#
#-----[ ADMINISTRATOR CONTROL PANEL ]-------------------
#
you will need to go into the Administrator Control Panel and go to General Admin: Configuration and under User and Forum Basic Settings change Allow HTML from No to Yes
#
#-----[ SQL ]------------------------------------------
#
ALTER TABLE `phpbb_users` CHANGE `user_allowhtml` `user_allowhtml` TINYINT( 1 ) DEFAULT '0'
(this will change the default value for the user_allowhtml field in the phpbb_users table from 1 to 0)
(you will also need to change the current values for all users (except admins) in this field from 1 to 0)
#
#End As far as I can tell, these coding changes allow only admins to post HTML in private messages and regular posts while completely removing HTML abilities for regular users. However, two things I've noticed:
1) New users registering still are having the user_allowhtml field in phpbb_users table set to 1 even though I changed the default to 0 (I'm guessing something in the php programming is overriding the default mysql setting...?
2) Even with these new users having the user_allowhtml field in the phpbb_users table set to 1 instead of 0, they still don't seem to be able to post HTML in private messages or regular posts...
3) It seems that when an admin has the user_allowhtml field value in the phpbb_users table changed from 1 to 0, they are still able to post HTML in regular posts and private messages, but the default is that the Disable HTML in this message is checked for their posts (whereas it doesn't appear for regular users post because they are totally unable to post HTML)...leading me to believe that it doesn't really matter whether user_allowhtml is set to 1 or 0 and some of my instructions above might me extraneous...
Any help regarding this or confirmation that it works and doesn't screw anything else up, or advice is greatly appreciated!! Thanks!
