[F] Mininum Message Length

[labrocca]

I started to type this today:

Quote:Well..I know this isn't really a bug report and it's not really a suggestion either. Just something I noticed today where a bug was reported in one of my plugins (min title length). Seems you can use a double whitespace to override count of my_strlen which doesn't take into account those characters. IMHO that's a bit of a bug (yes minor) as mybb does remove double white space from most of it's posts and such.

In the middle of that I decided to test the double whitespace issue with a post. Guess what I found. Min Message Length setting is broken in both 1.2.14 and 1.4 Beta 4. I have blank installs of both and neither works. Oddly though it seems to work here on Mybboard.

Here is my beta board:
http://beta.mybbcentral.com

If you want my phpinfo settings PM me. (PHP Version 5.2.5)

Not sure what is going on but it's odd.

OK...also checked a second host...same issue. I tried at mybbfans though and it works (same host as mybboard?).

IDIOT ME - Turns out as admin you don't have the min length. As a user account it works though.

So back to original bug then. You can override the limit with whitespace as shown here:

http://community.mybboard.net/thread-34420.html


lol at my bug report. I could have edited it but heck..it's funny imho.

---

EDIT: This will work if added to the my_strlen

PHP Code:

$str = preg_replace('/\s\s+/', ' ', $str); 


---

Oh...and I also see that you can use ALT 0160 trick:

http://www.worldstart.com/tips/tips.php/1506

I made a test thread here with empty text.

[Ryan Gordon]

If we start stripping multiple spaces blindly we cause other problems. I'm not counting this as an actual issue since a space is an actual character whether or not anyone likes it.

[labrocca]

Well it's not really stripping them it's removing them from the count in my_strlen. You already remove them adequetely in posts and messages imho. Since they do get stripped already in posts why not make sure that the characters placed into the database are the same ones counted in the function?

I know this is probably considered relatively minor but the fix is just as minor.

Also maybe you misunderstand. I don't want to strip whitespaces just count multiple whitespaces as one. "  " or "      " would be replaced with " " for the purpose of the count which would coincide with the actual database insertion.

[Ryan Gordon]

hmm... okay, but where would the fix go and lets not use pregex. $str = str_replace(' ', ' ', $str); should work just as fine

[labrocca]

Here is original function:

PHP Code:

function my_strlen($string)
{
    global $lang;

    $string = preg_replace("#&\#(0-9]+);#", "-", $string);

    if(strtolower($lang->settings['charset']) == "utf-8")
    {
        // Get rid of any excess RTL and LTR override for they are the workings of the devil
        $string = str_replace(dec_to_utf8(8238), "", $string);
        $string = str_replace(dec_to_utf8(8237), "", $string);

        // Remove dodgy whitespaces
        $string = str_replace(chr(0xCA), "", $string);
    }
    $string = trim($string);

    if(function_exists("mb_strlen"))
    {
        $string_length = mb_strlen($string);
    }
    else
    {
        $string_length = strlen($string);
    }

    return $string_length;
} 


Here is altered function:

PHP Code:

function my_strlen($string)
{
    global $lang;

    $string = preg_replace("#&\#(0-9]+);#", "-", $string);

    if(strtolower($lang->settings['charset']) == "utf-8")
    {
        // Get rid of any excess RTL and LTR override for they are the workings of the devil
        $string = str_replace(dec_to_utf8(8238), "", $string);
        $string = str_replace(dec_to_utf8(8237), "", $string);

        // Remove dodgy whitespaces
        $string = str_replace(chr(0xCA), "", $string);
        $string = str_replace("  ", " ", $string);
    }
    $string = trim($string);

    if(function_exists("mb_strlen"))
    {
        $string_length = mb_strlen($string);
    }
    else
    {
        $string_length = strlen($string);
    }

    return $string_length;
} 


One line should do it.

[Ryan Gordon]

That's not going to work. What if I have a username like "Ryan Gordon" - That's 11 characters, but the function would only return 10 which is wrong. And while it may not be a problem right now, it could most certainly cause many problems in the future.

[labrocca]

Well...maybe you aren't aware of this but mybb removes a double space from a username when signing up. Try it. I double checked the database to be sure.

Even in posts Mybb removes a double space which I wasn't even aware of before. However like I said...it can be used to circumvent the character count function.

"Ryan    Gordon" using the alt-0160 method
"Ryan Gordon" using basic space character

See.

And maybe you still don't understand...the function would only remove DOUBLE spaces...not single ones.

Here look. I made an empty post:
http://community.mybboard.net/thread-34431.html

Look in the database...I bet it's 3 characters which is below the minimum setting.

[Ryan Gordon]

Err, mis-read that. It's been a long day...

[labrocca]

Okay...I know sometimes we all make mistakes..as long as you understand now.

[Yumi]

MyBB doesn't remove double spaces, the browser does.

It's not an issue at all IMO. I can think of at least 3 ways in how you can bypass these minimum message lengths, and it's simply not possible to patch up all of these. (empty tags, "hidden" unicode characters, fake url tags etc)

EDIT: looks like I posted too late. Still, I don't think this is really an issue at all (and probably breaks more things than it fixes).