From: Mikael Nordfeldth <mmn@hethane.se>
Date: Wed, 3 Feb 2016 13:31:16 +0000 (+0100)
Subject: Only allow our specified URI schemes
X-Git-Url: https://git.mxchange.org/?a=commitdiff_plain;h=349dba8be0924534777732d17c1f37fa6a02dc26;p=quix0rs-gnu-social.git

Only allow our specified URI schemes
---

diff --git a/lib/util.php b/lib/util.php
index 5b28aa7aed..6026105cb1 100644
--- a/lib/util.php
+++ b/lib/util.php
@@ -581,6 +581,7 @@ function common_purify($html)
 
     $cfg = HTMLPurifier_Config::createDefault();
     $cfg->set('HTML.ForbiddenAttributes', array('style'));  // id, on* etc. are already filtered by default
+    $cfg->set('URI.AllowedSchemes', array_fill_keys(common_url_schemes(), true));
 
     // Remove more elements than what the default filter removes, default in GNU social are remotely
     // linked resources such as img, video, audio