From 6ccf502e95b39ca298d79cd2a502ae921c188bce Mon Sep 17 00:00:00 2001 From: Jean-Philippe Lang Date: Sun, 5 Apr 2020 15:02:01 +0000 Subject: Merged r19672 to 4.1-stable (#32934). git-svn-id: http://svn.redmine.org/redmine/branches/4.1-stable@19673 e93f8b46-1217-0410-a6f0-8f06a7374b81 --- lib/redmine/wiki_formatting/textile/redcloth3.rb | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'lib/redmine') diff --git a/lib/redmine/wiki_formatting/textile/redcloth3.rb b/lib/redmine/wiki_formatting/textile/redcloth3.rb index 54725d2bf..5b534df91 100644 --- a/lib/redmine/wiki_formatting/textile/redcloth3.rb +++ b/lib/redmine/wiki_formatting/textile/redcloth3.rb @@ -838,8 +838,12 @@ class RedCloth3 < String url = url[0..-2] # discard closing parenth from url post = ")" + post # add closing parenth to post end + + url = htmlesc(url.dup) + next all if url.downcase.start_with?('javascript:') + atts = pba(atts) - atts = +" href=\"#{htmlesc url}#{slash}\"#{atts}" + atts = +" href=\"#{url}#{slash}\"#{atts}" atts << " title=\"#{htmlesc title}\"" if title atts = shelve(atts) if atts external = (url =~ /^https?:\/\//) ? ' class="external"' : '' @@ -958,6 +962,10 @@ class RedCloth3 < String url, url_title = check_refs( url ) next m unless uri_with_safe_scheme?(url) + if href + href = htmlesc(href.dup) + next m if href.downcase.start_with?('javascript:') + end out = +'' out << "" if href -- cgit v1.2.3