UBB.Developers Forums UBB.threads 7 Development How Do I? HTML tag problem (EMBED, OBJECT)

Hi,

After upgrading to 6.5 I've discovered that I cannot use "EMBED" & "OBJECT" HTMLs tags ....

Anybudy Knows where is the problem ?

They're not permitted because of various malicious HTML exploits that utilize them.

What

Then how to add a flash or a real player ??

Very, very carefully, if at all. Both allow arbritary scripting to occur which may lead to exploits. Unless you have implicit trust for your users and know that they will not abuse the functions, you should not remove the filters for those elements.

Ok How could I remove the filters for those tags ?

Aren't there any other ways to use real player without removing the filters ?

Well, you can link to the .ra or .ram file directly using the [url] tag...

If you wish to take the very dangerous and risky step of disabling the filters for embed and object... I'm afraid that no one here will provide you with exact directions. Examine the code in sub check_html_core in ubb_lib. It shouldn't be too hard to figure out.

Again, I must warn you that malicious users can then potentially cause major problems on your board... doing this is not advised, ever. It's really better off if you don't disable the filters - they're there for your protection.

I understand the situation Charles and I really appreaciate ur concern

If u dont mind could I just ask about the HTML tag EMBED

What is its fuction and how extent problems might occur to the board if I alter the filter for only this tag ?

:rolleyes:

I would suggest not using :rolleyes: when asking a serious question.

Embed/object allow arbritary items to be inlined just into a page - not just plugins.

There are two main areas of concern.

First, Flash applets (among other things) can read and set cookies. There is a (remote) possibility that a flash app can be used to steal user login information. (While the password in the cookie is encrypted, the cookie can easily be reused by the attacker to log in as the user.)

Second, malicious users can use security problems in MSIE via Embed/object to cause it to either crash or do something nasty to the viewing computer.