Buffered bbcodes cause the buffer stack to be misordered

diff --git a/wcfsetup/install/files/lib/system/bbcode/HtmlBBCodeParser.class.php b/wcfsetup/install/files/lib/system/bbcode/HtmlBBCodeParser.class.php
index 0bd2e50c13b23660a9d8ae47a5f11c2bb094fb63..25897e04957d3be81f25062704cdefae8baebbbf 100644 (file)
--- a/wcfsetup/install/files/lib/system/bbcode/HtmlBBCodeParser.class.php
+++ b/wcfsetup/install/files/lib/system/bbcode/HtmlBBCodeParser.class.php
@@ -298,6 +298,11 @@ class HtmlBBCodeParser extends BBCodeParser {
                                if ($this->needBuffering($tag)) {
                                        // start buffering
                                        $tag['buffer'] = '';
+                                       
+                                       // reserve spot to ensure correct tag order
+                                       $tag['bufferPlaceholder'] = count($this->openTagIdentifiers);
+                                       $this->openTagIdentifiers[] = '_BUFFER_PLACEHOLDER_';
+                                       
                                        $bufferedTagStack[] = $tag;
                                        $buffer =& $bufferedTagStack[count($bufferedTagStack) - 1]['buffer'];
                                }
@@ -423,8 +428,10 @@ class HtmlBBCodeParser extends BBCodeParser {
                        return $tag['source'];
                }
                
+               $index = (isset($tag['bufferPlaceholder'])) ? $index = $tag['bufferPlaceholder'] : count($this->openTagIdentifiers);
+               
                $uuid = StringUtil::getUUID();
-               $this->openTagIdentifiers[] = [
+               $this->openTagIdentifiers[$index] = [
                        'name' => $name,
                        'uuid' => $uuid
                ];