Hi All,

We've got DNN v4.8.4, with forum module v4.4.3.40705.

We have a user who reports that anytime they put the word "alert" in their post, it cuts off everything after and including the word "alert."

I was able to replicate this numerous times, and I tried moving the word "alert" around.  Everytime, wherever I put "alert", everything after and including the word "alert" is stripped from the post.

I checked the bad word filter, and it's completely empty (no words in the filter list).  I tried disabling it anyway, just to see what would happen--no change in behavior.

Anyone else experiencing this behavior?

Just because I'm curious...

Alert

This appears after "alert".

I do have the exact same problem in my forum (DNN 4.8.3, Forum 4.4.3).

Interersting it doesn't seem to be a problem here. So I hope it is already fixed and the fix will be part of the next release.

Regards, Tom.

Here's what I found: on line 1172 of Forum_PostEdit.ascx.vb, we have this:

_Body = objSecurity.InputFilter(_Body, PortalSecurity.FilterFlag.NoScripting)

Before calling this method, _Body has the complete post.  After calling this method and reassigning the value of _Body, _Body has everything after and including "Alert" removed.  So, something in the objSecurity.InputFilter method is causing the issue.  I used Reflector to dig down through the DotNetNuke.dll assembly, and I think the culprit is this method of DotNetNuke.Security.PortalSecurity:

private string FilterStrings(string strInput)
{
    string input = strInput;
    List<string> list = new List<string>();
    list.Add("<script[^>]*>.*?</script[^><]*>");
    list.Add("<input[^>]*>.*?</input[^><]*>");
    list.Add("<object[^>]*>.*?</object[^><]*>");
    list.Add("<embed[^>]*>.*?</embed[^><]*>");
    list.Add("<applet[^>]*>.*?</applet[^><]*>");
    list.Add("<form[^>]*>.*?</form[^><]*>");
    list.Add("<option[^>]*>.*?</option[^><]*>");
    list.Add("<select[^>]*>.*?</select[^><]*>");
    list.Add("<iframe[^>]*>.*?</iframe[^><]*>");
    list.Add("<ilayer[^>]*>.*?</ilayer[^><]*>");
    list.Add("<form[^>]*>");
    list.Add("</form[^><]*>");
    list.Add(" ");
    list.Add(" ");
    list.Add("alert.*\\(?'?\"?'?\"?\\)?");
    RegexOptions options = RegexOptions.Singleline | RegexOptions.IgnoreCase;
    string replacement = " ";
    foreach (string str4 in list)
    {
        input = Regex.Replace(input, str4, replacement, options);
    }
    if (input.Contains("&gt;") & input.Contains("&lt;"))
    {
        foreach (string str5 in list)
        {
            input = Regex.Replace(input, HttpContext.Current.Server.HtmlEncode(str5), replacement, options);
        }
    }
    return input;
}

I believe it's there that we have a regex triggering a false positive on the word "alert."

Any word on when this will be fixed?

  -Josh