Add tag escaping to BBCode::setTags

diff --git a/src/Content/Text/BBCode.php b/src/Content/Text/BBCode.php
index d7afa1cd2f617486c814c0111c1d53b8fa2f4fa2..fb0d99d8ac902e37ba16b9420ccf2a862ca00173 100644 (file)
--- a/src/Content/Text/BBCode.php
+++ b/src/Content/Text/BBCode.php
@@ -2087,64 +2087,60 @@ class BBCode
        {
                $ret = [];
 
-               // Convert hashtag links to hashtags
-               $string = preg_replace('/#\[url\=([^\[\]]*)\](.*?)\[\/url\]/ism', '#$2 ', $string);
+               BBCode::performWithEscapedTags($string, ['noparse', 'pre', 'code'], function ($string) use (&$ret) {
+                       // Convert hashtag links to hashtags
+                       $string = preg_replace('/#\[url\=([^\[\]]*)\](.*?)\[\/url\]/ism', '#$2 ', $string);
 
-               // ignore anything in a code block
-               $string = preg_replace('/\[code.*?\].*?\[\/code\]/sm', '', $string);
+                       // Force line feeds at bbtags
+                       $string = str_replace(['[', ']'], ["\n[", "]\n"], $string);
 
-               // Force line feeds at bbtags
-               $string = str_replace(['[', ']'], ["\n[", "]\n"], $string);
+                       // ignore anything in a bbtag
+                       $string = preg_replace('/\[(.*?)\]/sm', '', $string);
 
-               // ignore anything in a bbtag
-               $string = preg_replace('/\[(.*?)\]/sm', '', $string);
+                       // Match full names against @tags including the space between first and last
+                       // We will look these up afterward to see if they are full names or not recognisable.
 
-               // Match full names against @tags including the space between first and last
-               // We will look these up afterward to see if they are full names or not recognisable.
-
-               if (preg_match_all('/(@[^ \x0D\x0A,:?]+ [^ \x0D\x0A@,:?]+)([ \x0D\x0A@,:?]|$)/', $string, $matches)) {
-                       foreach ($matches[1] as $match) {
-                               if (strstr($match, ']')) {
-                                       // we might be inside a bbcode color tag - leave it alone
-                                       continue;
-                               }
+                       if (preg_match_all('/(@[^ \x0D\x0A,:?]+ [^ \x0D\x0A@,:?]+)([ \x0D\x0A@,:?]|$)/', $string, $matches)) {
+                               foreach ($matches[1] as $match) {
+                                       if (strstr($match, ']')) {
+                                               // we might be inside a bbcode color tag - leave it alone
+                                               continue;
+                                       }
 
-                               if (substr($match, -1, 1) === '.') {
-                                       $ret[] = substr($match, 0, -1);
-                               } else {
-                                       $ret[] = $match;
+                                       if (substr($match, -1, 1) === '.') {
+                                               $ret[] = substr($match, 0, -1);
+                                       } else {
+                                               $ret[] = $match;
+                                       }
                                }
                        }
-               }
 
-               // Otherwise pull out single word tags. These can be @nickname, @first_last
-               // and #hash tags.
+                       // Otherwise pull out single word tags. These can be @nickname, @first_last
+                       // and #hash tags.
 
-               if (preg_match_all('/([!#@][^\^ \x0D\x0A,;:?]+)([ \x0D\x0A,;:?]|$)/', $string, $matches)) {
-                       foreach ($matches[1] as $match) {
-                               if (strstr($match, ']')) {
-                                       // we might be inside a bbcode color tag - leave it alone
-                                       continue;
-                               }
+                       if (preg_match_all('/([!#@][^\^ \x0D\x0A,;:?\']*[^\^ \x0D\x0A,;:?!\'.])/', $string, $matches)) {
+                               foreach ($matches[1] as $match) {
+                                       if (strstr($match, ']')) {
+                                               // we might be inside a bbcode color tag - leave it alone
+                                               continue;
+                                       }
 
-                               if (substr($match, -1, 1) === '.') {
-                                       $match = substr($match,0,-1);
-                               }
+                                       // ignore strictly numeric tags like #1
+                                       if ((strpos($match, '#') === 0) && ctype_digit(substr($match, 1))) {
+                                               continue;
+                                       }
 
-                               // ignore strictly numeric tags like #1
-                               if ((strpos($match, '#') === 0) && ctype_digit(substr($match, 1))) {
-                                       continue;
-                               }
+                                       // try not to catch url fragments
+                                       if (strpos($string, $match) && preg_match('/[a-zA-z0-9\/]/', substr($string, strpos($string, $match) - 1, 1))) {
+                                               continue;
+                                       }
 
-                               // try not to catch url fragments
-                               if (strpos($string, $match) && preg_match('/[a-zA-z0-9\/]/', substr($string, strpos($string, $match) - 1, 1))) {
-                                       continue;
+                                       $ret[] = $match;
                                }
-                               $ret[] = $match;
                        }
-               }
+               });
 
-               return $ret;
+               return array_unique($ret);
        }
 
        /**