diff options
| author | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2016-06-01 17:32:35 +0000 |
|---|---|---|
| committer | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2016-06-01 17:32:35 +0000 |
| commit | a4bc8980126f08323e758fc8f0edcd53594083d2 (patch) | |
| tree | dd767b1ce6016438eaee7f5e5a357ff5470be77d /lib/redcloth3.rb | |
| parent | 1be535443a2071d8143dd24f6727f29e82353548 (diff) | |
| download | redmine-a4bc8980126f08323e758fc8f0edcd53594083d2.tar.gz redmine-a4bc8980126f08323e758fc8f0edcd53594083d2.zip | |
Limits the schemes that inline images can use (#22926).
git-svn-id: http://svn.redmine.org/redmine/trunk@15433 e93f8b46-1217-0410-a6f0-8f06a7374b81
Diffstat (limited to 'lib/redcloth3.rb')
| -rw-r--r-- | lib/redcloth3.rb | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/lib/redcloth3.rb b/lib/redcloth3.rb index f9c9054b8..b96ee7ab0 100644 --- a/lib/redcloth3.rb +++ b/lib/redcloth3.rb @@ -165,6 +165,7 @@ # class RedCloth::Textile.new( str ) class RedCloth3 < String + include Redmine::Helpers::URL VERSION = '3.0.4' DEFAULT_RULES = [:textile, :markdown] @@ -960,6 +961,8 @@ class RedCloth3 < String href, alt_title = check_refs( href ) if href url, url_title = check_refs( url ) + return m unless uri_with_safe_scheme?(url) + out = '' out << "<a#{ shelve( " href=\"#{ href }\"" ) }>" if href out << "<img#{ shelve( atts ) } />" |