From d8bd1921eec4b0e1ae6e87fecab0eccde2576117 Mon Sep 17 00:00:00 2001
From: Peter Liebetrau <peter.liebetrau@gmail.com>
Date: Tue, 29 Jan 2019 21:17:11 +0100
Subject: [PATCH] BBcode, Tags - fix BBCode created tags in [code] blocks, fix
 usage of multiple ## created tags

---
 src/Content/Text/BBCode.php |  2 +-
 src/Model/Item.php          | 39 ++++++++++++++++++++++++++++++-------
 2 files changed, 33 insertions(+), 8 deletions(-)

diff --git a/src/Content/Text/BBCode.php b/src/Content/Text/BBCode.php
index 2c2054750..e0190c0c1 100644
--- a/src/Content/Text/BBCode.php
+++ b/src/Content/Text/BBCode.php
@@ -1178,7 +1178,7 @@ class BBCode extends BaseObject
 		// Extracting multi-line code blocks before the whitespace processing
 		$codeblocks = [];
 
-		$text = preg_replace_callback("#\[code(?:=([^\]]*))?\](.*?)\[\/code\]#is",
+		$text = preg_replace_callback("#\[code(?:=([^\]]*))?\](.*?)\[\/code\]#ism",
 			function ($matches) use (&$codeblocks) {
 				$return = $matches[0];
 				if (strpos($matches[2], "\n") !== false) {
diff --git a/src/Model/Item.php b/src/Model/Item.php
index 67071db31..192c9b141 100644
--- a/src/Model/Item.php
+++ b/src/Model/Item.php
@@ -2400,6 +2400,17 @@ class Item extends BaseObject
 
 		$URLSearchString = "^\[\]";
 
+		// What happens in [code], stays in [code]!
+		// escape the # and the [
+		// hint: we will also get in trouble with #tags, when we want markdown in posts -> ### Headline 3
+		$item["body"] = preg_replace_callback("/\[code(.*)\](.*?)\[\/code\]/ism",
+			function ($match) {
+				// we truly ESCape all # and [ to prevent gettin weird tags in [code] blocks
+				$find = ['#', '['];
+				$replace = [chr(27).'sharp', chr(27).'leftsquarebracket'];
+				return ("[code" . str_replace($find, $replace, $match[1]) . "]" . $match[2] . "[/code]");
+			}, $item["body"]);
+		
 		// All hashtags should point to the home server if "local_tags" is activated
 		if (Config::get('system', 'local_tags')) {
 			$item["body"] = preg_replace("/#\[url\=([$URLSearchString]*)\](.*?)\[\/url\]/ism",
@@ -2435,21 +2446,35 @@ class Item extends BaseObject
 			}
 
 			$basetag = str_replace('_',' ',substr($tag,1));
+			if($basetag[0] != '#') { 
+				$newtag = '#[url=' . System::baseUrl() . '/search?tag=' . $basetag . ']' . $basetag . '[/url]';
 
-			$newtag = '#[url=' . System::baseUrl() . '/search?tag=' . $basetag . ']' . $basetag . '[/url]';
+				$item["body"] = str_replace($tag, $newtag, $item["body"]);
 
-			$item["body"] = str_replace($tag, $newtag, $item["body"]);
-
-			if (!stristr($item["tag"], "/search?tag=" . $basetag . "]" . $basetag . "[/url]")) {
-				if (strlen($item["tag"])) {
-					$item["tag"] = ',' . $item["tag"];
+				if (!stristr($item["tag"], "/search?tag=" . $basetag . "]" . $basetag . "[/url]")) {
+					if (strlen($item["tag"])) {
+						$item["tag"] = ',' . $item["tag"];
+					}
+					$item["tag"] = $newtag . $item["tag"];
 				}
-				$item["tag"] = $newtag . $item["tag"];
 			}
 		}
 
 		// Convert back the masked hashtags
 		$item["body"] = str_replace("&num;", "#", $item["body"]);
+
+		// Remember! What happens in [code], stays in [code]
+		// roleback the # and [
+		$item["body"] = preg_replace_callback("/\[code(.*)\](.*?)\[\/code\]/ism",
+			function ($match) {
+				// we truly unESCape all sharp and leftsquarebracket
+				$find = [chr(27).'sharp', chr(27).'leftsquarebracket'];
+				$replace = ['#', '['];
+				return ("[code" . str_replace($find, $replace, $match[1]) . "]" . $match[2] . "[/code]");
+			}, $item["body"]);
+
+		// Convert back the masked hashtags
+		$item["body"] = str_replace("&num;", "#", $item["body"]);
 	}
 
 	public static function getGuidById($id)