X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=application%2FUrl.php;h=b37593773b920c26d3a9e5332d197dc17fb44449;hb=31cefb9ac144c7a62001a015f9d122076c94d5ec;hp=61a30a7800972d8d8c22fdad98a4023e1c561b23;hpb=86deafe0ff5a22a37255546cf82325e89bf272b1;p=github%2Fshaarli%2FShaarli.git

diff --git a/application/Url.php b/application/Url.php
index 61a30a78..b3759377 100644
--- a/application/Url.php
+++ b/application/Url.php
@@ -62,21 +62,31 @@ function add_trailing_slash($url)
 {
     return $url . (!endsWith($url, '/') ? '/' : '');
 }
+
 /**
- * Converts an URL with an IDN host to a ASCII one.
+ * Replace not whitelisted protocols by 'http://' from given URL.
  *
- * @param string $url Input URL.
+ * @param string $url       URL to clean
+ * @param array  $protocols List of allowed protocols (aside from http(s)).
  *
- * @return string converted URL.
+ * @return string URL with allowed protocol
  */
-function url_with_idn_to_ascii($url)
+function whitelist_protocols($url, $protocols)
 {
-    $parts = parse_url($url);
-    $parts['host'] = idn_to_ascii($parts['host']);
-
-    $httpUrl = new \http\Url($parts);
-    return $httpUrl->toString();
+    if (startsWith($url, '?') || startsWith($url, '/')) {
+        return $url;
+    }
+    $protocols = array_merge(['http', 'https'], $protocols);
+    $protocol = preg_match('#^(\w+):/?/?#', $url, $match);
+    // Protocol not allowed: we remove it and replace it with http
+    if ($protocol === 1 && ! in_array($match[1], $protocols)) {
+        $url = str_replace($match[0], 'http://', $url);
+    } else if ($protocol !== 1) {
+        $url = 'http://' . $url;
+    }
+    return $url;
 }
+
 /**
  * URL representation and cleanup utilities
  *
@@ -99,6 +109,7 @@ class Url
         'action_type_map=',
         'fb_',
         'fb=',
+        'PHPSESSID=',
 
         // Scoop.it
         '__scoop',
@@ -107,7 +118,10 @@ class Url
         'utm_',
 
         // ATInternet
-        'xtor='
+        'xtor=',
+
+        // Other
+        'campaign_'
     );
 
     private static $annoyingFragments = array(
@@ -240,7 +254,7 @@ class Url
      *
      * @return string converted cleaned up URL.
      */
-    public function indToAscii()
+    public function idnToAscii()
     {
         $out = $this->cleanup();
         if (! function_exists('idn_to_ascii') || ! isset($this->parts['host'])) {