Tupambae_Org/friendica_2021-01
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Add check for allowed URL in OEmbed

Browse source 
- Add mixed-content mitigating
This commit is contained in:
Hypolite Petovan 2018-01-04 12:01:46 -05:00
parent 50e04d87c2
commit d416243964
1 changed files with 28 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
src/Content/OEmbed.php
View file

@ -8,9 +8,9 @@ namespace Friendica\Content;
use Friendica\Core\Cache; use Friendica\Core\Cache;
use Friendica\Core\System; use Friendica\Core\System;
use Friendica\ParseUrl;
use Friendica\Core\Config; use Friendica\Core\Config;
use Friendica\Database\DBM; use Friendica\Database\DBM;
use Friendica\ParseUrl;
use dba; use dba;
use DOMDocument; use DOMDocument;
use DOMXPath; use DOMXPath;
@ -193,8 +193,8 @@ class OEmbed
break; break;
case "rich": case "rich":
// not so safe.. // not so safe..
if (!Config::get("system", "no_oembed_rich_content")) { if (self::isAllowedURL($embedurl)) {
$ret.= proxy_parse_html($jhtml); $ret .= proxy_parse_html($jhtml);
} }
break; break;
} }
@ -315,7 +315,10 @@ class OEmbed
} }
$width = '100%'; $width = '100%';
$s = System::baseUrl() . '/oembed/' . base64url_encode($src); // Only proxy OEmbed URLs to avoid mixed-content errors
if (Config::get('system', 'ssl_policy') == SSL_POLICY_FULL && parse_url($src, PHP_URL_SCHEME) !== 'https') {
$src = System::baseUrl() . '/oembed/' . base64url_encode($src);
}
return '<iframe onload="resizeIframe(this);" class="embed_rich" height="' . $height . '" width="' . $width . '" src="' . $s . '" allowfullscreen scrolling="no" frameborder="no">' . t('Embedded content') . '</iframe>'; return '<iframe onload="resizeIframe(this);" class="embed_rich" height="' . $height . '" width="' . $width . '" src="' . $s . '" allowfullscreen scrolling="no" frameborder="no">' . t('Embedded content') . '</iframe>';
} }
@ -352,4 +355,25 @@ class OEmbed
} }
return $innerHTML; return $innerHTML;
} }
/**
* Determines if rich content OEmbed is allowed for the provided URL
*
* @brief Determines if rich content OEmbed is allowed for the provided URL
* @param string $url
* @return boolean
*/
private static function isAllowedURL($url)
{
if (!Config::get('system', 'no_oembed_rich_content')) {
return true;
}
$domain = parse_url($url, PHP_URL_HOST);
$str_allowed = Config::get('system', 'allowed_oembed', '');
$allowed = explode(',', $str_allowed);
return allowed_domain($domain, $allowed, true);
}
} }