diff options
| author | Lauris BH <lauris@nix.lv> | 2018-08-15 09:29:37 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-08-15 09:29:37 +0300 |
| commit | 92466129ec242536c71b66a8987d9b37e6bc0bce (patch) | |
| tree | b9ac6959ef6365a6215868cba4083f53b74fa094 /routers | |
| parent | 0449330dbce812e67f3309c11e265eb6a5bc0c7e (diff) | |
| download | gitea-92466129ec242536c71b66a8987d9b37e6bc0bce.tar.gz gitea-92466129ec242536c71b66a8987d9b37e6bc0bce.zip | |
Improve URL validation for external wiki and external issues (#4710)
* Improve URL validation for external wiki and external issues
* Do not allow also localhost address for external URLs
Diffstat (limited to 'routers')
| -rw-r--r-- | routers/repo/setting.go | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/routers/repo/setting.go b/routers/repo/setting.go index b1f50d5387..dc558ff209 100644 --- a/routers/repo/setting.go +++ b/routers/repo/setting.go @@ -1,4 +1,5 @@ // Copyright 2014 The Gogs Authors. All rights reserved. +// Copyright 2018 The Gitea Authors. All rights reserved. // Use of this source code is governed by a MIT-style // license that can be found in the LICENSE file. @@ -17,6 +18,7 @@ import ( "code.gitea.io/gitea/modules/log" "code.gitea.io/gitea/modules/setting" "code.gitea.io/gitea/modules/util" + "code.gitea.io/gitea/modules/validation" "code.gitea.io/gitea/routers/utils" ) @@ -157,7 +159,7 @@ func SettingsPost(ctx *context.Context, form auth.RepoSettingForm) { if form.EnableWiki { if form.EnableExternalWiki { - if !strings.HasPrefix(form.ExternalWikiURL, "http://") && !strings.HasPrefix(form.ExternalWikiURL, "https://") { + if !validation.IsValidExternalURL(form.ExternalWikiURL) { ctx.Flash.Error(ctx.Tr("repo.settings.external_wiki_url_error")) ctx.Redirect(repo.Link() + "/settings") return @@ -181,11 +183,16 @@ func SettingsPost(ctx *context.Context, form auth.RepoSettingForm) { if form.EnableIssues { if form.EnableExternalTracker { - if !strings.HasPrefix(form.ExternalTrackerURL, "http://") && !strings.HasPrefix(form.ExternalTrackerURL, "https://") { + if !validation.IsValidExternalURL(form.ExternalTrackerURL) { ctx.Flash.Error(ctx.Tr("repo.settings.external_tracker_url_error")) ctx.Redirect(repo.Link() + "/settings") return } + if len(form.TrackerURLFormat) != 0 && !validation.IsValidExternalURL(form.TrackerURLFormat) { + ctx.Flash.Error(ctx.Tr("repo.settings.tracker_url_format_error")) + ctx.Redirect(repo.Link() + "/settings") + return + } units = append(units, models.RepoUnit{ RepoID: repo.ID, Type: models.UnitTypeExternalTracker, |