mirror of
https://github.com/phpbb/phpbb.git
synced 2025-06-10 21:38:54 +00:00
[ticket/security/257] Enforce http(s) for URLs in image BBCode
SECURITY-257
This commit is contained in:
parent
20d64270a4
commit
3ecd2f150d
3 changed files with 10 additions and 1 deletions
|
@ -390,7 +390,7 @@ class bbcode_firstpass extends bbcode
|
||||||
$in = str_replace(' ', '%20', $in);
|
$in = str_replace(' ', '%20', $in);
|
||||||
|
|
||||||
// Checking urls
|
// Checking urls
|
||||||
if (!preg_match('#^' . get_preg_expression('url') . '$#iu', $in) && !preg_match('#^' . get_preg_expression('www_url') . '$#iu', $in))
|
if (!preg_match('#^' . get_preg_expression('url_http') . '$#iu', $in) && !preg_match('#^' . get_preg_expression('www_url') . '$#iu', $in))
|
||||||
{
|
{
|
||||||
return '[img]' . $in . '[/img]';
|
return '[img]' . $in . '[/img]';
|
||||||
}
|
}
|
||||||
|
|
|
@ -120,6 +120,11 @@ class phpbb_bbcode_parser_test extends \phpbb_test_case
|
||||||
'[img]https://area51.phpbb.com/images/area51.png[/img]',
|
'[img]https://area51.phpbb.com/images/area51.png[/img]',
|
||||||
'[img:]https://area51.phpbb.com/images/area51.png[/img:]',
|
'[img:]https://area51.phpbb.com/images/area51.png[/img:]',
|
||||||
),
|
),
|
||||||
|
array(
|
||||||
|
'Test default bbcodes: img with unsupported protocol',
|
||||||
|
'[img]foo://foo/bar[/img]',
|
||||||
|
'[img]foo://foo/bar[/img]',
|
||||||
|
),
|
||||||
array(
|
array(
|
||||||
'Test default bbcodes: simple url',
|
'Test default bbcodes: simple url',
|
||||||
'[url]https://area51.phpbb.com/[/url]',
|
'[url]https://area51.phpbb.com/[/url]',
|
||||||
|
|
|
@ -132,6 +132,10 @@ class phpbb_textformatter_s9e_default_formatting_test extends phpbb_test_case
|
||||||
'[img]https://area51.phpbb.com/images/area51.png[/img]',
|
'[img]https://area51.phpbb.com/images/area51.png[/img]',
|
||||||
'<img src="https://area51.phpbb.com/images/area51.png" class="postimage" alt="Image">'
|
'<img src="https://area51.phpbb.com/images/area51.png" class="postimage" alt="Image">'
|
||||||
),
|
),
|
||||||
|
array(
|
||||||
|
'[img]foo://area51.phpbb.com/images/area51.png[/img]',
|
||||||
|
'[img]foo://area51.phpbb.com/images/area51.png[/img]'
|
||||||
|
),
|
||||||
array(
|
array(
|
||||||
'[url]https://area51.phpbb.com/[/url]',
|
'[url]https://area51.phpbb.com/[/url]',
|
||||||
'<a href="https://area51.phpbb.com/" class="postlink">https://area51.phpbb.com/</a>'
|
'<a href="https://area51.phpbb.com/" class="postlink">https://area51.phpbb.com/</a>'
|
||||||
|
|
Loading…
Add table
Reference in a new issue