From: Alexander Ebert <ebert@woltlab.com>
Date: Wed, 28 Sep 2016 12:45:47 +0000 (+0200)
Subject: Buffered bbcodes cause the buffer stack to be misordered
X-Git-Tag: 3.0.0_Beta_2~85
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=8a94d7c45b5c18466e6990636d412c14f382bf70;p=GitHub%2FWoltLab%2FWCF.git

Buffered bbcodes cause the buffer stack to be misordered
---

diff --git a/wcfsetup/install/files/lib/system/bbcode/HtmlBBCodeParser.class.php b/wcfsetup/install/files/lib/system/bbcode/HtmlBBCodeParser.class.php
index 0bd2e50c13..25897e0495 100644
--- a/wcfsetup/install/files/lib/system/bbcode/HtmlBBCodeParser.class.php
+++ b/wcfsetup/install/files/lib/system/bbcode/HtmlBBCodeParser.class.php
@@ -298,6 +298,11 @@ class HtmlBBCodeParser extends BBCodeParser {
 				if ($this->needBuffering($tag)) {
 					// start buffering
 					$tag['buffer'] = '';
+					
+					// reserve spot to ensure correct tag order
+					$tag['bufferPlaceholder'] = count($this->openTagIdentifiers);
+					$this->openTagIdentifiers[] = '_BUFFER_PLACEHOLDER_';
+					
 					$bufferedTagStack[] = $tag;
 					$buffer =& $bufferedTagStack[count($bufferedTagStack) - 1]['buffer'];
 				}
@@ -423,8 +428,10 @@ class HtmlBBCodeParser extends BBCodeParser {
 			return $tag['source'];
 		}
 		
+		$index = (isset($tag['bufferPlaceholder'])) ? $index = $tag['bufferPlaceholder'] : count($this->openTagIdentifiers);
+		
 		$uuid = StringUtil::getUUID();
-		$this->openTagIdentifiers[] = [
+		$this->openTagIdentifiers[$index] = [
 			'name' => $name,
 			'uuid' => $uuid
 		];