Web Wiz - Green Windows Web Hosting - Celebrating 25 Years!
Web Wiz Homepage Search Web Wiz

  New Posts New Posts RSS Feed - Problem with urls containing | or []
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

Problem with urls containing | or []
 Post Reply Post Reply Page  12>
Author
  Topic Search Topic Search  Topic Options Topic Options
mantey View Drop Down
Groupie
Groupie
Avatar

Joined: 03 May 2005
Status: Offline
Points: 57 		Post Options Post Options   Thanks (0) Thanks(0)   Quote mantey Quote  Post ReplyReply Direct Link To This Post Topic: Problem with urls containing | or []
    Posted: 18 December 2005 at 9:12pm
I want to ask some question. Some URLs have special characters like | or [ or ]. When I type the URL containing this characters in the wyswyg editor it ignores them after submiting a post. So there is URL with all characters except those one, mentioned above. Of course such URLs are not valid.
 
How to solve this problem?


Edited by mantey - 22 December 2005 at 3:22am
Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844 		Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 19 December 2005 at 6:20am
These caracters are not usauly use din URL's and are removed to prevent XSS hacking
Web Wiz Forums Hosting
ASP.NET Web Hosting
Back to Top
mantey View Drop Down
Groupie
Groupie
Avatar

Joined: 03 May 2005
Status: Offline
Points: 57 		Post Options Post Options   Thanks (0) Thanks(0)   Quote mantey Quote  Post ReplyReply Direct Link To This Post Posted: 26 December 2005 at 11:14pm
So there is no way to get such URLs to work using wysiwyg, or is it?
 
Does anybody have any suggestion how to solve this problem?
Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844 		Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 27 December 2005 at 1:29pm
You could edit the filters file in the functions directory and remove the part of the filter that filters out [ and ], but you leave a security whole that could mean your forum is hacked by an XSS hacker.
Web Wiz Forums Hosting
ASP.NET Web Hosting
Back to Top
mantey View Drop Down
Groupie
Groupie
Avatar

Joined: 03 May 2005
Status: Offline
Points: 57 		Post Options Post Options   Thanks (0) Thanks(0)   Quote mantey Quote  Post ReplyReply Direct Link To This Post Posted: 27 December 2005 at 10:27pm

Is it possible to make some mod, letting only administrator to have special rights, so only administrators (or only one administrator) would be able to use special characters in URLs?
Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844 		Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 28 December 2005 at 2:05pm
You could use code to detect if it is the admin and then not apply the filters:-

If blnAdmin = false Then

    do code in here
End If
Web Wiz Forums Hosting
ASP.NET Web Hosting
Back to Top
JJLatWebWiz View Drop Down
Groupie
Groupie
Avatar

Joined: 02 March 2005
Location: United States
Status: Offline
Points: 136 		Post Options Post Options   Thanks (0) Thanks(0)   Quote JJLatWebWiz Quote  Post ReplyReply Direct Link To This Post Posted: 28 December 2005 at 11:31pm
I believe (but I won't bet much money on it) that the vertical line, and square bracket characters are among the "national" characters that could have different meanings depending on the user's (or the host server's) selected national character variant 7 bit set.  As such, according to W3C, those characters should not be used in a URL.  They should be escaped.  Some simple changes to the the formatLink function in functions_filters.asp would probably do the trick.
 
Maybe make the following changes:


strInputEntry = Replace(strInputEntry, "[", "[", 1, -1, 1)


strInputEntry = Replace(strInputEntry, "]", "]", 1, -1, 1)


strInputEntry = Replace(strInputEntry, "(", "(", 1, -1, 1)


strInputEntry = Replace(strInputEntry, ")", ")", 1, -1, 1)


strInputEntry = Replace(strInputEntry, "{", "{", 1, -1, 1)


strInputEntry = Replace(strInputEntry, "}", "}", 1, -1, 1)


strInputEntry = Replace(strInputEntry, "<", "&#60;", 1, -1, 1)


strInputEntry = Replace(strInputEntry, ">", "&#62;", 1, -1, 1)


strInputEntry = Replace(strInputEntry, "|", "&#124;", 1, -1, 1)

I haven't tested these suggestions in any way and I haven't analyzed their possible impact on security.  I haven't even verified the escape codes are exactly correct.  I THINK security will be uneffected and I'm pretty sure the codes are accurate.  But I don't accept any responsibility should anyone choose to test my theory.  If you have problems with it, I will gladly help via this forum.


Edited by JJLatWebWiz - 29 December 2005 at 6:44pm
p.s. I'm not affiliated with Web Wiz Guide in any way. I'm just an average Web Wiz user repaying my debt for the use of their fine forum by trying to help other Web Wiz Guide users.
Back to Top
JJLatWebWiz View Drop Down
Groupie
Groupie
Avatar

Joined: 02 March 2005
Location: United States
Status: Offline
Points: 136 		Post Options Post Options   Thanks (0) Thanks(0)   Quote JJLatWebWiz Quote  Post ReplyReply Direct Link To This Post Posted: 29 December 2005 at 6:44pm

Now, I'm not sure if you should use the hash ASCII HTML Encoding or the URL Encoding escape codes.  I think, probably the latter.  So you should probably use this instead:



strInputEntry = Replace(strInputEntry, "[", "%5B", 1, -1, 1)


strInputEntry = Replace(strInputEntry, "]", "%5D", 1, -1, 1)


strInputEntry = Replace(strInputEntry, "(", "%28", 1, -1, 1)


strInputEntry = Replace(strInputEntry, ")", "%29", 1, -1, 1)


strInputEntry = Replace(strInputEntry, "{", "%7B", 1, -1, 1)


strInputEntry = Replace(strInputEntry, "}", "%7D", 1, -1, 1)


strInputEntry = Replace(strInputEntry, "<", "%3C", 1, -1, 1)


strInputEntry = Replace(strInputEntry, ">", "%3E", 1, -1, 1)


strInputEntry = Replace(strInputEntry, "|", "%7C", 1, -1, 1)

p.s. I'm not affiliated with Web Wiz Guide in any way. I'm just an average Web Wiz user repaying my debt for the use of their fine forum by trying to help other Web Wiz Guide users.
Back to Top
 Post Reply Post Reply Page  12>

Forum Jump Forum Permissions View Drop Down

Forum Software by Web Wiz Forums® version 12.08
Copyright ©2001-2026 Web Wiz Ltd.

Become a Fan on Facebook Follow us on X Connect with us on LinkedIn Web Wiz Blogs
About Web Wiz | Contact Web Wiz | Terms & Conditions | Cookies | Privacy Notice

Web Wiz is the trading name of Web Wiz Ltd. Company registration No. 05977755. Registered in England and Wales.
Registered office: Web Wiz Ltd, Unit 18, The Glenmore Centre, Fancy Road, Poole, Dorset, BH12 4FB, UK.

Prices exclude VAT at 20% unless otherwise stated. VAT No. GB988999105 - $, € prices shown as a guideline only.

Copyright ©2001-2026 Web Wiz Ltd. All rights reserved.