Severity: HIGH
Location: src/Controllers/ForumController.php:2185-2196
Bug: $_POST['rules'] trimmed/length-capped then stored. Rendered later via toHtml without purify().
Fix: MarkdownService::purify($rules) before write.
Status: open. Will reply with remediation details when resolved.
Resolved.
ForumController::saveRules now runs the raw rules text through MarkdownService::purify() before writing to forums.rules (src/Controllers/ForumController.php). A forum mod can no longer persist <script> / <iframe> / on*= attributes into the DB.
Render-time rendering in splitRules() already passes each block through toHtml() which itself purifies; this change adds defence in depth at write time so the stored value is always safe regardless of the render path.
Locking this thread.
We noticed you are visiting from a mobile device. We are glad you are here, but know that 6502ish is best experienced on the desktop. Some features are not easily used via mobile and your experience may vary from the full experience via desktop.