From 8b662ba0eb90d01ca0e87574409989b8bd32a7dc Mon Sep 17 00:00:00 2001
From: flashwave <me@flash.moe>
Date: Mon, 12 Dec 2016 19:59:35 +0100
Subject: [PATCH] change bbcode parse order + code tag sanitising

---
 app/BBCode/Parser.php    | 34 +++++++++++++++++-----------------
 app/BBCode/Tags/Code.php |  4 ++--
 2 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/app/BBCode/Parser.php b/app/BBCode/Parser.php
index a88996d..f513a28 100644
--- a/app/BBCode/Parser.php
+++ b/app/BBCode/Parser.php
@@ -21,6 +21,23 @@ class Parser
      * @var array
      */
     public static $parsers = [
+        // Advanced parsing
+        Tags\Code::class,
+        Tags\Box::class,
+        Tags\ListTag::class,
+        Tags\UserTag::class,
+        Tags\Markdown::class,
+
+        // Quotes
+        Tags\NamedQuote::class,
+        Tags\Quote::class,
+
+        // More advanced
+        Tags\Colour::class,
+        Tags\Align::class,
+        Tags\Size::class,
+        Tags\YouTube::class,
+
         // Basic markup
         Tags\Bold::class,
         Tags\Italics::class,
@@ -30,27 +47,10 @@ class Parser
         Tags\Image::class,
         Tags\Spoiler::class,
 
-        // More advanced
-        Tags\Colour::class,
-        Tags\Align::class,
-        Tags\Size::class,
-        Tags\YouTube::class,
-
         // Links
         Tags\NamedLink::class,
         Tags\Link::class,
 
-        // Quotes
-        Tags\NamedQuote::class,
-        Tags\Quote::class,
-
-        // Advanced parsing
-        Tags\Box::class,
-        Tags\Code::class,
-        Tags\ListTag::class,
-        Tags\UserTag::class,
-        Tags\Markdown::class,
-
         // Newline must always be last
         Tags\Newline::class,
     ];
diff --git a/app/BBCode/Tags/Code.php b/app/BBCode/Tags/Code.php
index b0b6d4b..7d7bb84 100644
--- a/app/BBCode/Tags/Code.php
+++ b/app/BBCode/Tags/Code.php
@@ -28,9 +28,9 @@ class Code extends TagBase
             '/\[code(?:\=([a-z]+))?\](.*?)\[\/code\]/s',
             function ($matches) {
                 $class = strlen($matches[1]) ? "lang-{$matches[1]}" : '';
-                // htmlencode bbcode characters here as well
+                $text = str_replace(['[', ']'], ['&#91;', '&#93;'], $matches[2]);
 
-                return "<pre class='bbcode__code'><code class='bbcode__code-container {$class}'>{$matches[2]}</code></pre>";
+                return "<pre class='bbcode__code'><code class='bbcode__code-container {$class}'>{$text}</code></pre>";
             },
             $text
         );