From a64caea9b627cb6fd4b5f9123d3479c08b4328c4 Mon Sep 17 00:00:00 2001
From: David M <davidmj@users.sourceforge.net>
Date: Thu, 18 Jan 2007 05:09:35 +0000
Subject: [PATCH] - found a small bug in the list parser while working on
 another bug

git-svn-id: file:///svn/phpbb/trunk@6898 89ea8834-ac86-4346-8a33-228a782c2dd0
---
 phpBB/includes/message_parser.php | 33 +++++++++++++++++++------------
 1 file changed, 20 insertions(+), 13 deletions(-)

diff --git a/phpBB/includes/message_parser.php b/phpBB/includes/message_parser.php
index ab0ee59943..e5e2240b6d 100644
--- a/phpBB/includes/message_parser.php
+++ b/phpBB/includes/message_parser.php
@@ -513,8 +513,8 @@ class bbcode_firstpass extends bbcode
 				// if $tok is ']' the buffer holds a tag
 				if (strtolower($buffer) == '/list' && sizeof($list_end_tags))
 				{
-					// valid [/list] tag
-					if (sizeof($item_end_tags))
+					// valid [/list] tag, check nesting so that we don't hit false positives
+					if (sizeof($item_end_tags) && sizeof($item_end_tags) >= sizeof($list_end_tags))
 					{
 						// current li tag has not been closed
 						$out = preg_replace('/\n?\[$/', '[', $out) . array_pop($item_end_tags) . '][';
@@ -568,10 +568,7 @@ class bbcode_firstpass extends bbcode
 					}
 					else if ($buffer == '/*')
 					{
-						if (array_pop($item_end_tags) == '/*:m:' . $this->bbcode_uid)
-						{
-							array_pop($item_end_tags);
-						}
+						array_pop($item_end_tags);
 						$buffer = '/*:' . $this->bbcode_uid;
 					}
 
@@ -1182,16 +1179,26 @@ class parse_message extends bbcode_firstpass
 		{
 			if ($max_smilies)
 			{
-				$num_matches = preg_match_all('#' . str_replace('#', '', implode('|', $match)) . '#', $this->message, $matches);
-				unset($matches);
-
-				if ($num_matches !== false && $num_matches > $max_smilies)
+				$count = 0;
+				foreach ($match as $key => $smilie)
 				{
-					$this->warn_msg[] = sprintf($user->lang['TOO_MANY_SMILIES'], $max_smilies);
-					return;
+					if ($small_count = preg_match_all($smilie, $this->message, $array))
+					{
+						$count += $small_count;
+						if ($count > $max_smilies)
+						{
+							$this->warn_msg[] = sprintf($user->lang['TOO_MANY_SMILIES'], $max_smilies);
+							return;
+						}
+					}
+					$this->message = preg_replace($smilie, $replace[$key], $this->message);
 				}
+				$this->message = trim($this->message);
+			}
+			else
+			{
+				$this->message = trim(preg_replace($match, $replace, $this->message));
 			}
-			$this->message = trim(preg_replace($match, $replace, $this->message));
 		}
 	}