bitPickups/friendica_2020-09-1_sharedHosting
1
0
Fork 0
Code Pull requests Activity

Merge pull request #7514 from MrPetovan/bug/7507-allow-protocolless

Browse source 
Allow protocol-less links
This commit is contained in:
Michael Vogel 2019-08-15 22:07:09 +02:00 committed by GitHub
parent feb720a3ee 0f9520f520
commit 6f944f1e53
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
src/Content/Text/BBCode.php
View file

@ -1753,18 +1753,25 @@ class BBCode extends BaseObject
$text = preg_replace('/\<([^>]*?)(src|href)=(.*?)\&amp\;(.*?)\>/ism', '<$1$2=$3&$4>', $text);
// sanitizes src attributes (http and redir URLs for displaying in a web page, cid used for inline images in emails)
$allowed_src_protocols = ['http', 'redir', 'cid'];
$allowed_src_protocols = ['//', 'http://', 'https://', 'redir/', 'cid:'];
array_walk($allowed_src_protocols, function(&$value) { $value = preg_quote($value, '#');});
$text = preg_replace('#<([^>]*?)(src)="(?!' . implode('|', $allowed_src_protocols) . ')(.*?)"(.*?)>#ism',
'<$1$2=""$4 data-original-src="$3" class="invalid-src" title="' . L10n::t('Invalid source protocol') . '">', $text);
// sanitize href attributes (only whitelisted protocols URLs)
// default value for backward compatibility
$allowed_link_protocols = Config::get('system', 'allowed_link_protocols', ['ftp', 'mailto', 'gopher', 'cid']);
$allowed_link_protocols = Config::get('system', 'allowed_link_protocols', []);
// Always allowed protocol even if config isn't set or not including it
$allowed_link_protocols[] = 'http';
$allowed_link_protocols[] = '//';
$allowed_link_protocols[] = 'http://';
$allowed_link_protocols[] = 'https://';
$allowed_link_protocols[] = 'redir/';
array_walk($allowed_link_protocols, function(&$value) { $value = preg_quote($value, '#');});
$regex = '#<([^>]*?)(href)="(?!' . implode('|', $allowed_link_protocols) . ')(.*?)"(.*?)>#ism';
$text = preg_replace($regex, '<$1$2="javascript:void(0)"$4 data-original-href="$3" class="invalid-href" title="' . L10n::t('Invalid link protocol') . '">', $text);

4
static/defaults.config.php
View file

@ -52,8 +52,8 @@ return [
],
'system' => [
// allowed_link_protocols (Array)
// Allowed protocols in links URLs, add at your own risk. http is always allowed.
'allowed_link_protocols' => ['ftp', 'ftps', 'mailto', 'cid', 'gopher'],
// Allowed protocols in links URLs, add at your own risk. http(s) is always allowed.
'allowed_link_protocols' => ['ftp://', 'ftps://', 'mailto:', 'cid:', 'gopher://'],
// always_show_preview (Boolean)
// Only show small preview pictures.