User Title Formatting Messes With Group Image Code

[Vashnik]

Formatting user titles through a usergroup's default user title (Admin CP -> Users & Groups -> Groups -> usergroup -> Default User Title) and adding a Group Image results in a piece of code next to the Group Image.
   

Default User Title:

<span style="color: red; background: url(./images/rc599e.gif);">Network Administrator</span>

Not sure if the Usergroup Style might play a role in the issue with the default user title, so I'm including it just in case, along with the CSS used for it.
Username Style:

<span class="userglowNA"><b><i>{username}</i></b></span>

CSS Code

.userglowNA
{
   color: #F00;
   text-shadow: 1px 0px 10px #AA0000;
   background: url(./images/rc599e.gif);
}

.userglowNA:link .userglowNA:hover, .userglowNA:focus, .userglowNA:active
{
   -webkit-stroke-width: 5.3px;
   -webkit-stroke-color: #F00;
   -webkit-fill-color: #F00;
   text-shadow: 1px 0px 10px #FF0000;
   -webkit-transition: width 0.3s;
   transition: width 0.3s;
   -moz-transition: width 0.3s;
   -o-transition: width 0.3s;
}

.userglowNA a
{
   -webkit-transition: all 0.3s ease-in;
   transition: all 0.3s ease-in;
   -moz-transition: all 0.3s ease-in;
   -o-transition: all 0.3s ease-in;
   text-decoration:none;
   color:red;
}

A "Group Image" must be specified for the bug to appear, suggesting that the User Title (at least the Default User Title from the group settings in the ACP) and Group Image are directly related to the bug.

MyBB 1.6 has a usergroup configured in the same way as the MyBB 1.8 Beta 1 group. Both have this same problem. The bug was first found in MyBB 1.8 Beta 1 and then found in MyBB 1.6.13

[Vashnik]

This bug is still present in MyBB 1.6.14 and MyBB 1.8 Beta 2.

[mmadhankumar]

yes i can confirm this... and the cause is the image link found in member_profile_groupimage template... $usertitle is getting the html used in the "Default User title" field and messing up....

<img src="{$displaygroup['image']}" alt="{$usertitle}" title="{$usertitle}" /><br />

[Vashnik]

Bump, the bug is still there in MyBB 1.6.15 and MyBB 1.8 Beta 3.

[dragonexpert]

The real thing is that usertitles are not meant to be used in that way. They really were meant to be just plain text, not HTML.

[Vashnik]

The real thing is that usertitles are not meant to be used in that way. They really were meant to be just plain text, not HTML.

That just further points out that it's a bug. Either support formatted HTML usertitles (and remove usertitle dependency for group images) or strip all formatting for usertitles upon saving the usergroup's settings, especially if the usertitles are going to be used for the image titles for the group images. Unless MyBB plans on taking the Microsoft approach to this and wants to claim "it's not a bug, it's a feature" in which someone on the staff could at least add the "rejected" prefix. 710 views and still went ignored until yesterday (depending on time zone). Impressive. Sure, it's probably more of a minor defacing type bug and probably doesn't pose much of a security risk (if at all), but the bug still shows an incomplete product for the front end of it.

After exploring the postbit_groupimage template and using it as an example to find a fix for member_profile_groupimage, {$usertitle} should be replaced with {$displaygroup['title']} to get the desired affect and still support formatted usertitles.
Example postbit_groupimage template:

<img src="{$usergroup['image']}" alt="{$usergroup['title']}" title="{$usergroup['title']}" />

Example member_profile_groupimage template (old):

<img src="{$displaygroup['image']}" alt="{$usertitle}" title="{$usertitle}" /><br />

Example member_profile_groupimage template (fixed):

<img src="{$displaygroup['image']}" alt="{$displaygroup['title']}" title="{$displaygroup['title']}" /><br />

Note that I took the example of postbit_groupimage where it consistently used the $usergroup variable array and forged a fix by applying the same concept to the member_profile_groupimage template.