From c246ffa184a5c773c05dfa568188575aa978f3ed Mon Sep 17 00:00:00 2001 From: Jean-Philippe Lang Date: Wed, 1 Jun 2016 16:55:37 +0000 Subject: Limits the schemes that Markdown links can use (#22924). git-svn-id: http://svn.redmine.org/redmine/trunk@15431 e93f8b46-1217-0410-a6f0-8f06a7374b81 --- lib/redmine/wiki_formatting/markdown/formatter.rb | 3 +++ 1 file changed, 3 insertions(+) (limited to 'lib/redmine/wiki_formatting') diff --git a/lib/redmine/wiki_formatting/markdown/formatter.rb b/lib/redmine/wiki_formatting/markdown/formatter.rb index 62ad6f14e..2d6f66559 100644 --- a/lib/redmine/wiki_formatting/markdown/formatter.rb +++ b/lib/redmine/wiki_formatting/markdown/formatter.rb @@ -22,8 +22,11 @@ module Redmine module Markdown class HTML < Redcarpet::Render::HTML include ActionView::Helpers::TagHelper + include Redmine::Helpers::URL def link(link, title, content) + return nil unless uri_with_safe_scheme?(link) + css = nil unless link && link.starts_with?('/') css = 'external' -- cgit v1.2.3