From 86ceea054f5f85157b04473bac5bfb6ff86ca31f Mon Sep 17 00:00:00 2001 From: ArthurHoaro Date: Thu, 25 May 2017 14:52:42 +0200 Subject: Add a whitelist of protocols for URLs - for Shaare - for markdown description links and images Not whitelisted protocols will be replaced by `http://` --- index.php | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) (limited to 'index.php') diff --git a/index.php b/index.php index 468dd091..944af674 100644 --- a/index.php +++ b/index.php @@ -1237,13 +1237,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history) // Remove duplicates. $tags = implode(' ', array_unique(explode(' ', $tags))); - $url = trim($_POST['lf_url']); - if (! startsWith($url, 'http:') && ! startsWith($url, 'https:') - && ! startsWith($url, 'ftp:') && ! startsWith($url, 'magnet:') - && ! startsWith($url, '?') && ! startsWith($url, 'javascript:') - ) { - $url = 'http://' . $url; - } + $url = whitelist_protocols(trim($_POST['lf_url']), $conf->get('security.allowed_protocols')); $link = array( 'id' => $id, -- cgit v1.2.3