From 1be535443a2071d8143dd24f6727f29e82353548 Mon Sep 17 00:00:00 2001
From: Jean-Philippe Lang <jp_lang@yahoo.fr>
Date: Wed, 1 Jun 2016 16:58:19 +0000
Subject: [PATCH] Limits the schemes that project homepage can use (#22925).

git-svn-id: http://svn.redmine.org/redmine/trunk@15432 e93f8b46-1217-0410-a6f0-8f06a7374b81
---
 app/helpers/application_helper.rb | 1 +
 app/views/projects/show.html.erb  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index 3e857e3d9..c727d0be5 100644
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -28,6 +28,7 @@ module ApplicationHelper
   include Redmine::SudoMode::Helper
   include Redmine::Themes::Helper
   include Redmine::Hook::Helper
+  include Redmine::Helpers::URL
 
   extend Forwardable
   def_delegators :wiki_helper, :wikitoolbar_for, :heads_for_wiki_formatter
diff --git a/app/views/projects/show.html.erb b/app/views/projects/show.html.erb
index 33f423ca5..007f0fab2 100644
--- a/app/views/projects/show.html.erb
+++ b/app/views/projects/show.html.erb
@@ -26,7 +26,7 @@
   <% if @project.homepage.present? || @subprojects.any? || @project.visible_custom_field_values.any?(&:present?) %>
   <ul>
   <% unless @project.homepage.blank? %>
-    <li><span class="label"><%=l(:field_homepage)%>:</span> <%= link_to @project.homepage, @project.homepage %></li>
+    <li><span class="label"><%=l(:field_homepage)%>:</span> <%= link_to_if uri_with_safe_scheme?(@project.homepage), @project.homepage, @project.homepage %></li>
   <% end %>
   <% if @subprojects.any? %>
     <li><span class="label"><%=l(:label_subproject_plural)%>:</span>
-- 
2.39.5