diff options
| author | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2016-06-01 17:32:35 +0000 |
|---|---|---|
| committer | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2016-06-01 17:32:35 +0000 |
| commit | a4bc8980126f08323e758fc8f0edcd53594083d2 (patch) | |
| tree | dd767b1ce6016438eaee7f5e5a357ff5470be77d /lib/redmine/wiki_formatting | |
| parent | 1be535443a2071d8143dd24f6727f29e82353548 (diff) | |
| download | redmine-a4bc8980126f08323e758fc8f0edcd53594083d2.tar.gz redmine-a4bc8980126f08323e758fc8f0edcd53594083d2.zip | |
Limits the schemes that inline images can use (#22926).
git-svn-id: http://svn.redmine.org/redmine/trunk@15433 e93f8b46-1217-0410-a6f0-8f06a7374b81
Diffstat (limited to 'lib/redmine/wiki_formatting')
| -rw-r--r-- | lib/redmine/wiki_formatting/markdown/formatter.rb | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/lib/redmine/wiki_formatting/markdown/formatter.rb b/lib/redmine/wiki_formatting/markdown/formatter.rb index 2d6f66559..4afbc2fdd 100644 --- a/lib/redmine/wiki_formatting/markdown/formatter.rb +++ b/lib/redmine/wiki_formatting/markdown/formatter.rb @@ -43,6 +43,12 @@ module Redmine "<pre>" + CGI.escapeHTML(code) + "</pre>" end end + + def image(link, title, alt_text) + return unless uri_with_safe_scheme?(link) + + tag('img', :src => link, :alt => alt_text || "", :title => title) + end end class Formatter |