There is a problem with the group custom username style. I am using
this username style and it's giving me this error (as said in title). As you can see by the code, there isn't any script, meta or base tags in the code. I think this is a problem, thanks.
The Regex is weird if it should only disallow those tags:
preg_match("#<((m[^a])|(b[^diloru>])|(s[^aemptu>]))(\s*[^>]*)>#si", $mybb->input['namestyle'])
Not sure whether we really need to disallow anything else. If noone has any other opinion on this I'll push this later
The regex indeed doesn't allow <svg> and likely some other HTML5 elements since it's quite old.
But you won't be able to use that style anyways because it's too long for the field, IIRC.
We should still improve the regex shouldn't we?
I don't see why not. It's also used in several otherplaces or at least parser, IIRC