diff options
| author | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2016-06-01 16:55:37 +0000 |
|---|---|---|
| committer | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2016-06-01 16:55:37 +0000 |
| commit | c246ffa184a5c773c05dfa568188575aa978f3ed (patch) | |
| tree | 94d016bc1cf22fc6b55542e949478509bccfc59d /lib/redmine/wiki_formatting | |
| parent | a6828512c02b20eaeb9c42fc2612c7010ede73fa (diff) | |
| download | redmine-c246ffa184a5c773c05dfa568188575aa978f3ed.tar.gz redmine-c246ffa184a5c773c05dfa568188575aa978f3ed.zip | |
Limits the schemes that Markdown links can use (#22924).
git-svn-id: http://svn.redmine.org/redmine/trunk@15431 e93f8b46-1217-0410-a6f0-8f06a7374b81
Diffstat (limited to 'lib/redmine/wiki_formatting')
| -rw-r--r-- | lib/redmine/wiki_formatting/markdown/formatter.rb | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/lib/redmine/wiki_formatting/markdown/formatter.rb b/lib/redmine/wiki_formatting/markdown/formatter.rb index 62ad6f14e..2d6f66559 100644 --- a/lib/redmine/wiki_formatting/markdown/formatter.rb +++ b/lib/redmine/wiki_formatting/markdown/formatter.rb @@ -22,8 +22,11 @@ module Redmine module Markdown class HTML < Redcarpet::Render::HTML include ActionView::Helpers::TagHelper + include Redmine::Helpers::URL def link(link, title, content) + return nil unless uri_with_safe_scheme?(link) + css = nil unless link && link.starts_with?('/') css = 'external' |