diff options
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/redmine/wiki_formatting/textile/redcloth3.rb | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/lib/redmine/wiki_formatting/textile/redcloth3.rb b/lib/redmine/wiki_formatting/textile/redcloth3.rb index c292926a5..9062fca0d 100644 --- a/lib/redmine/wiki_formatting/textile/redcloth3.rb +++ b/lib/redmine/wiki_formatting/textile/redcloth3.rb @@ -841,7 +841,7 @@ class RedCloth3 < String end url = htmlesc(url.dup) - next all if url.downcase.start_with?('javascript:') + next all unless uri_with_link_safe_scheme?(url) atts = pba(atts) atts = +" href=\"#{url}#{slash}\"#{atts}" @@ -965,7 +965,7 @@ class RedCloth3 < String next m unless uri_with_safe_scheme?(url.partition('?').first) if href href = htmlesc(href.dup) - next m if href.downcase.start_with?('javascript:') + next m unless uri_with_link_safe_scheme?(href) end out = +'' @@ -1214,9 +1214,9 @@ class RedCloth3 < String all, tag, close = $1, $2, $3 if close.present? && (ALLOWED_TAGS.include?(tag) || (tag =~ /\Aredpre#\d+\z/)) - "<#{all}#{close}" + "<#{htmlesc all}#{close}" else - "<#{all}#{'>' unless close.blank?}" + "<#{htmlesc all}#{'>' unless close.blank?}" end end end |