quick reply with quote - usernames with single quotes in?

[Quiff Boy]

i'm running v2.0.15 (upgraded over time from an original of 2.0.3)

i've had smartor's "quick reply with quote" hack - http://www.phpbbhacks.com/download/540 - in since day 1, but recently i've noticed that it messes up the quote when replying to posts by users with a single quotation mark in their name

anyone else experienced this?

for example, i have user called "spiggy's hat" - if i use the quick reply box to reply his posts i see this:

Code: Select all

[QUOTE="Spiggythisisareply

it gets itself in a twist when it hits the single quote

i dont know if its a recent thing - i suspect its been in there all along but no one has noticed it before

presumably its just something that needs escaping, but where?

[Quiff Boy]

ack!

the html text that the script outputs looks like so:

Code: Select all

<input type='hidden' name='message' value='' /> 

<input type='hidden' name='last_msg' value='[QUOTE="username"].....'>

the tags use single quotes - thus the script is getting

Code: Select all

<input type='hidden' name='message' value='' /> 

<input type='hidden' name='last_msg' value='[QUOTE="Spiggy's Hat"].....'>

and gets the single quotes all mixed up and interprets it as:

Code: Select all

<input type='hidden' name='last_msg' value='[QUOTE="Spiggy' _random characters the html parser can't understand so ignores_ >

any ideas how to fix that?

[Thoul]

Easy to fix, but the board won't display the fix correctly in a post. So, have a look here.

[Quiff Boy]

beautiful!

thanks

[baerenwurm]

Hi.

Could someone repost the fix please? Get a 404 error: http://www.phpbbhacks.com/support/thoul/qrwq.txt

Relevant code:

Code: Select all

//
// Quick Reply Mod
//
if ( ((!$is_auth['auth_reply']) or ($forum_topic_data['forum_status'] == FORUM_LOCKED) or ($forum_topic_data['topic_status'] == TOPIC_LOCKED)) and ($userdata['user_level'] != ADMIN) )
{
	$quick_reply_form = "";
}
else
{
	if ($can_watch_topic and $is_watching_topic)
	{
		$notify_user = 1;
	}
	else
	{
		$notify_user = $userdata['user_notify'];
	}
	$attach_sig = (( $userdata['session_logged_in'] ) ? $userdata['user_attachsig'] : 0) ? '1' : '';
	$bbcode_uid = $postrow[$total_posts - 1]['bbcode_uid'];
	$last_poster = $postrow[$total_posts - 1]['username'];
	$last_msg = $postrow[$total_posts - 1]['post_text'];
	$last_msg = str_replace(":1:$bbcode_uid", "", $last_msg);
	$last_msg = str_replace(":u:$bbcode_uid", "", $last_msg);
	$last_msg = str_replace(":o:$bbcode_uid", "", $last_msg);
	$last_msg = str_replace(":$bbcode_uid", "", $last_msg);
	$last_msg = str_replace("'", "'", $last_msg);
	$last_msg = "[QUOTE=\"$last_poster\"]" . $last_msg . "[/QUOTE]";
	$quick_reply_form = "
	<script language='JavaScript' type='text/javascript'>
		function checkForm()
		{
			formErrors = false;
			document.post.message.value = '';
			if (document.post.input.value.length < 2) {
				formErrors = '" . $lang['Empty_message'] . "';
			}
			if (formErrors) {
				alert(formErrors);
				return false;
			} else {
				if (document.post.quick_quote.checked) {
					document.post.message.value = document.post.last_msg.value;
				}
				document.post.message.value += document.post.input.value;
				document.post.post.value='" . $lang["Sending"] . "';
				setTimeout('document.post.post.disabled = true', 0);
				return true;
			}
		}
	</script>
	<form action='".append_sid("posting.$phpEx")."' method='post' name='post' onsubmit='return checkForm(this)'>
	<span class='genmedwhite'><b>".$lang["Quick_Reply"].":</b><br />";

	if (!$userdata['session_logged_in'])
	{
		$quick_reply_form .= $lang['Username'] . ":&nbsp;<input class='post' type='text' name='username' size='25' maxlength='25' value='' /><br />";
	}

	$quick_reply_form .= "<textarea name='input' rows='10' cols='50' wrap='virtual' class='post''></textarea><br />
	<input type='checkbox' class='box' name='quick_quote' />".$lang["Quick_quote"]."<br />
	<input type='hidden' name='attach_sig' value='" . $attach_sig . "' />
	<input type='hidden' name='mode' value='reply' />
	<input type='hidden' name='sid' value='" . $userdata['session_id'] . "' />
	<input type='hidden' name='t' value='" . $topic_id . "' />
	<input type='hidden' name='message' value='' />
	<input type='hidden' name='notify' value=" . $notify_user  . " />
	<input type='hidden' name='last_msg' value='" . $last_msg  . "' />
	<input type='submit' name='preview' class='liteoption' value='".$lang['Preview']."' />&nbsp;
	<input type='submit' name='post' class='mainoption' value='".$lang["Submit"]."' />
	</form></span>";
}

$template->assign_vars(array(
	'QUICK_REPLY_FORM' => $quick_reply_form)
);
//
// END Quick Reply Mod
//

[Thoul]

I don't have the original fix any more, but this should take care of it:

Replace:

Code: Select all

   $quick_reply_form .= "<textarea name='input' rows='10' cols='50' wrap='virtual' class='post''></textarea><br />
   <input type='checkbox' class='box' name='quick_quote' />".$lang["Quick_quote"]."<br />
   <input type='hidden' name='attach_sig' value='" . $attach_sig . "' />
   <input type='hidden' name='mode' value='reply' />
   <input type='hidden' name='sid' value='" . $userdata['session_id'] . "' />
   <input type='hidden' name='t' value='" . $topic_id . "' />
   <input type='hidden' name='message' value='' />
   <input type='hidden' name='notify' value=" . $notify_user  . " />
   <input type='hidden' name='last_msg' value='" . $last_msg  . "' />
   <input type='submit' name='preview' class='liteoption' value='".$lang['Preview']."' />&nbsp;
   <input type='submit' name='post' class='mainoption' value='".$lang["Submit"]."' />
   </form></span>"; 

With:

Code: Select all

   $quick_reply_form .= '<textarea name="input" rows="10" cols="50" wrap="virtual" class="post"></textarea><br />
   <input type="checkbox" class="box" name="quick_quote" />'.$lang["Quick_quote"].'<br />
   <input type="hidden" name="attach_sig" value="' . $attach_sig . '" />
   <input type="hidden" name="mode" value="reply" />
   <input type="hidden" name="sid" value="' . $userdata['session_id'] . '" />
   <input type="hidden" name="t" value="' . $topic_id . '" />
   <input type="hidden" name="message" value="" />
   <input type="hidden" name="notify" value="' . $notify_user  . '" />
   <input type="hidden" name="last_msg" value="' . htmlspecialchars($last_msg)  . '" />
   <input type="submit" name="preview" class="liteoption" value="'.$lang['Preview'].'" />&nbsp;
   <input type="submit" name="post" class="mainoption" value="'.$lang["Submit"].'" />
   </form></span>';

[baerenwurm]

Thanks for your help!

With the new code that error always occurs now though, no matter if there is a quotation mark in the last poster's name or not.

[Thoul]

Sorry about that. I have made some adjustments to the new code above. Try it again see how it does this time.

[baerenwurm]

Thanks a lot - that solved the problem!

[Patrick]

Nicely done, Jeremy.

Thanks,

Patrick