keith/friendica
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Adding default protocols on missing config value for backward compatibility

Browse source
This commit is contained in:
Hypolite Petovan 2016-12-07 23:18:10 -05:00
parent 88e336b3bc
commit cd354d3a57
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
include/bbcode.php
View file

@ -1169,9 +1169,10 @@ function bbcode($Text,$preserve_nl = false, $tryoembed = true, $simplehtml = fal
$Text = preg_replace('#<([^>]*?)(src)="(?!http|redir)(.*?)"(.*?)>#ism', '<$1$2=""$4 class="invalid-src" title="' . t('Invalid source protocol') . '">', $Text);
// sanitize href attributes (only whitelisted protocols URLs)
$allowed_link_protocols = Config::get('system', 'allowed_link_protocols', array());
// default value for backward compatibility
$allowed_link_protocols = Config::get('system', 'allowed_link_protocols', array('ftp', 'mailto', 'gopher', 'cid'));
// Always allowed protocol even if config isn't set
// Always allowed protocol even if config isn't set or not including it
$allowed_link_protocols[] = 'http';
$regex = '#<([^>]*?)(href)="(?!' . implode('|', $allowed_link_protocols) . ')(.*?)"(.*?)>#ism';