Match mentions later because they are less specific

Parts like `@example` can legitimately appears as part of a link that gets auto-detected.

This issue was discovered when an URL was pasted that happens to also match a user that is named `document`. The "offending" URL was: `https://developer.mozilla.org/de/docs/Web/CSS/@document`

The `@document` is recognized as part of a mention because the forward slash is a valid token that matches the boundary condition (`\b`) of the regex for mentions.

See https://community.woltlab.com/thread/292020-automatische-link-umwandlung-schl%C3%A4gt-fehlt/

diff --git a/wcfsetup/install/files/lib/system/html/input/node/HtmlInputNodeTextParser.class.php b/wcfsetup/install/files/lib/system/html/input/node/HtmlInputNodeTextParser.class.php
index 7c9366b4a881575743a02976a9f0ed78bbc8687f..d3a2605a0a407afb21b3a14ff975b90fb2b3ea44 100644 (file)
--- a/wcfsetup/install/files/lib/system/html/input/node/HtmlInputNodeTextParser.class.php
+++ b/wcfsetup/install/files/lib/system/html/input/node/HtmlInputNodeTextParser.class.php
@@ -199,10 +199,6 @@ class HtmlInputNodeTextParser
             $node = $nodes[$i];
             $oldValue = $value = $node->textContent;
 
-            if (!empty($users) || !empty($groups)) {
-                $value = $this->parseMention($node, $value, $users, $groups);
-            }
-
             if ($allowURL || $allowMedia) {
                 $value = $this->parseURL($node, $value, $allowURL, $allowMedia);
             }
@@ -215,6 +211,10 @@ class HtmlInputNodeTextParser
                 $value = $this->parseSmiley($node, $value);
             }
 
+            if (!empty($users) || !empty($groups)) {
+                $value = $this->parseMention($node, $value, $users, $groups);
+            }
+
             if ($value !== $oldValue) {
                 $node->nodeValue = $value;
             }