From 349dba8be0924534777732d17c1f37fa6a02dc26 Mon Sep 17 00:00:00 2001 From: Mikael Nordfeldth Date: Wed, 3 Feb 2016 14:31:16 +0100 Subject: [PATCH] Only allow our specified URI schemes --- lib/util.php | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/util.php b/lib/util.php index 5b28aa7aed..6026105cb1 100644 --- a/lib/util.php +++ b/lib/util.php @@ -581,6 +581,7 @@ function common_purify($html) $cfg = HTMLPurifier_Config::createDefault(); $cfg->set('HTML.ForbiddenAttributes', array('style')); // id, on* etc. are already filtered by default + $cfg->set('URI.AllowedSchemes', array_fill_keys(common_url_schemes(), true)); // Remove more elements than what the default filter removes, default in GNU social are remotely // linked resources such as img, video, audio