From a4bc8980126f08323e758fc8f0edcd53594083d2 Mon Sep 17 00:00:00 2001
From: Jean-Philippe Lang <jp_lang@yahoo.fr>
Date: Wed, 1 Jun 2016 17:32:35 +0000
Subject: Limits the schemes that inline images can use (#22926).

git-svn-id: http://svn.redmine.org/redmine/trunk@15433 e93f8b46-1217-0410-a6f0-8f06a7374b81
---
 lib/redmine/wiki_formatting/markdown/formatter.rb | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'lib/redmine/wiki_formatting/markdown')

diff --git a/lib/redmine/wiki_formatting/markdown/formatter.rb b/lib/redmine/wiki_formatting/markdown/formatter.rb
index 2d6f66559..4afbc2fdd 100644
--- a/lib/redmine/wiki_formatting/markdown/formatter.rb
+++ b/lib/redmine/wiki_formatting/markdown/formatter.rb
@@ -43,6 +43,12 @@ module Redmine
             "<pre>" + CGI.escapeHTML(code) + "</pre>"
           end
         end
+
+        def image(link, title, alt_text)
+          return unless uri_with_safe_scheme?(link)
+
+          tag('img', :src => link, :alt => alt_text || "", :title => title)
+        end
       end
 
       class Formatter
-- 
cgit v1.2.3