diff options
-rw-r--r-- | index.php | 17 | ||||
-rw-r--r-- | tpl/linklist.html | 2 | ||||
-rw-r--r-- | tpl/page.header.html | 2 |
3 files changed, 16 insertions, 5 deletions
@@ -1265,7 +1265,11 @@ function renderPage() | |||
1265 | if (isset($_GET['linksperpage'])) | 1265 | if (isset($_GET['linksperpage'])) |
1266 | { | 1266 | { |
1267 | if (is_numeric($_GET['linksperpage'])) { $_SESSION['LINKS_PER_PAGE']=abs(intval($_GET['linksperpage'])); } | 1267 | if (is_numeric($_GET['linksperpage'])) { $_SESSION['LINKS_PER_PAGE']=abs(intval($_GET['linksperpage'])); } |
1268 | header('Location: '.(empty($_SERVER['HTTP_REFERER'])?'?':$_SERVER['HTTP_REFERER'])); | 1268 | // Make sure the referer is from Shaarli itself. |
1269 | $referer = '?'; | ||
1270 | if (!empty($_SERVER['HTTP_REFERER']) && strcmp(parse_url($_SERVER['HTTP_REFERER'],PHP_URL_HOST),$_SERVER['SERVER_NAME'])==0) | ||
1271 | $referer = $_SERVER['HTTP_REFERER']; | ||
1272 | header('Location: '.$referer); | ||
1269 | exit; | 1273 | exit; |
1270 | } | 1274 | } |
1271 | 1275 | ||
@@ -1280,7 +1284,11 @@ function renderPage() | |||
1280 | { | 1284 | { |
1281 | unset($_SESSION['privateonly']); // See all links | 1285 | unset($_SESSION['privateonly']); // See all links |
1282 | } | 1286 | } |
1283 | header('Location: '.(empty($_SERVER['HTTP_REFERER'])?'?':$_SERVER['HTTP_REFERER'])); | 1287 | // Make sure the referer is from Shaarli itself. |
1288 | $referer = '?'; | ||
1289 | if (!empty($_SERVER['HTTP_REFERER']) && strcmp(parse_url($_SERVER['HTTP_REFERER'],PHP_URL_HOST),$_SERVER['SERVER_NAME'])==0) | ||
1290 | $referer = $_SERVER['HTTP_REFERER']; | ||
1291 | header('Location: '.$referer); | ||
1284 | exit; | 1292 | exit; |
1285 | } | 1293 | } |
1286 | 1294 | ||
@@ -1437,7 +1445,10 @@ function renderPage() | |||
1437 | if (!tokenOk($_POST['token'])) die('Wrong token.'); // Go away ! | 1445 | if (!tokenOk($_POST['token'])) die('Wrong token.'); // Go away ! |
1438 | $tags = trim(preg_replace('/\s\s+/',' ', $_POST['lf_tags'])); // Remove multiple spaces. | 1446 | $tags = trim(preg_replace('/\s\s+/',' ', $_POST['lf_tags'])); // Remove multiple spaces. |
1439 | $linkdate=$_POST['lf_linkdate']; | 1447 | $linkdate=$_POST['lf_linkdate']; |
1440 | $link = array('title'=>trim($_POST['lf_title']),'url'=>trim($_POST['lf_url']),'description'=>trim($_POST['lf_description']),'private'=>(isset($_POST['lf_private']) ? 1 : 0), | 1448 | $url = trim($_POST['lf_url']); |
1449 | if (!startsWith($url,'http:') && !startsWith($url,'ftp:') && !startsWith($url,'magnet:') && !startsWith($url,'?')) | ||
1450 | $url = 'http://'.$url; | ||
1451 | $link = array('title'=>trim($_POST['lf_title']),'url'=>$url,'description'=>trim($_POST['lf_description']),'private'=>(isset($_POST['lf_private']) ? 1 : 0), | ||
1441 | 'linkdate'=>$linkdate,'tags'=>str_replace(',',' ',$tags)); | 1452 | 'linkdate'=>$linkdate,'tags'=>str_replace(',',' ',$tags)); |
1442 | if ($link['title']=='') $link['title']=$link['url']; // If title is empty, use the URL as title. | 1453 | if ($link['title']=='') $link['title']=$link['url']; // If title is empty, use the URL as title. |
1443 | $LINKSDB[$linkdate] = $link; | 1454 | $LINKSDB[$linkdate] = $link; |
diff --git a/tpl/linklist.html b/tpl/linklist.html index 3a703512..37ffeb64 100644 --- a/tpl/linklist.html +++ b/tpl/linklist.html | |||
@@ -40,7 +40,7 @@ | |||
40 | <input type="hidden" name="token" value="{$token}"><input type="hidden" name="delete_link"><input type="image" alt="Delete" src="images/delete_icon.png#" title="Delete" class="button_delete" onClick="return confirmDeleteLink();"></form> | 40 | <input type="hidden" name="token" value="{$token}"><input type="hidden" name="delete_link"><input type="image" alt="Delete" src="images/delete_icon.png#" title="Delete" class="button_delete" onClick="return confirmDeleteLink();"></form> |
41 | </div> | 41 | </div> |
42 | {/if} | 42 | {/if} |
43 | <span class="linktitle"><a href="{$redirector}{$value.url}">{$value.title|htmlspecialchars}</a></span> | 43 | <span class="linktitle"><a href="{$redirector}{$value.url|htmlspecialchars}">{$value.title|htmlspecialchars}</a></span> |
44 | <br> | 44 | <br> |
45 | {if="$value.description"}<div class="linkdescription"{if condition="$search_type=='permalink'"} style="max-height:none !important;"{/if}>{$value.description}</div>{/if} | 45 | {if="$value.description"}<div class="linkdescription"{if condition="$search_type=='permalink'"} style="max-height:none !important;"{/if}>{$value.description}</div>{/if} |
46 | {if="!$GLOBALS['config']['HIDE_TIMESTAMPS'] || isLoggedIn()"} | 46 | {if="!$GLOBALS['config']['HIDE_TIMESTAMPS'] || isLoggedIn()"} |
diff --git a/tpl/page.header.html b/tpl/page.header.html index 60fc1767..125b365b 100644 --- a/tpl/page.header.html +++ b/tpl/page.header.html | |||
@@ -2,7 +2,7 @@ | |||
2 | <div id="logo" title="Share your links !" onclick="document.location='?';"></div> | 2 | <div id="logo" title="Share your links !" onclick="document.location='?';"></div> |
3 | <div style="float:right; font-style:italic; color:#bbb; text-align:right; padding:0 5 0 0;" class="nomobile">Shaare your links...<br> | 3 | <div style="float:right; font-style:italic; color:#bbb; text-align:right; padding:0 5 0 0;" class="nomobile">Shaare your links...<br> |
4 | {if="!empty($linkcount)"}{$linkcount} links{/if}</div> | 4 | {if="!empty($linkcount)"}{$linkcount} links{/if}</div> |
5 | <span id="shaarli_title"><a href="?">{$shaarlititle}</a></span> | 5 | <span id="shaarli_title"><a href="?">{$shaarlititle|htmlspecialchars}</a></span> |
6 | 6 | ||
7 | {if="!empty($_GET['source']) && $_GET['source']=='bookmarklet'"} | 7 | {if="!empty($_GET['source']) && $_GET['source']=='bookmarklet'"} |
8 | {ignore} When called as a popup from bookmarklet, do not display menu. {/ignore} | 8 | {ignore} When called as a popup from bookmarklet, do not display menu. {/ignore} |