beenull/yellow
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Allow clickable phone numbers (tel: URIs) (#697)

Browse source 
Extend the regexp related to "error-xss-filter" to include the tel: URI scheme.
This commit is contained in:
jubjubbird 2021-10-12 11:14:35 +00:00 committed by GitHub
parent 370057097c
commit 7263c18b71
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
system/extensions/core.php
View file

@ -2288,7 +2288,7 @@ class YellowLookup {
$location = str_replace("/./", "/", $location);
$location = str_replace(":", $this->yellow->toolbox->getLocationArgumentsSeparator(), $location);
} else {
if ($filterStrict && !preg_match("/^(http|https|ftp|mailto):/", $location)) $location = "error-xss-filter";
if ($filterStrict && !preg_match("/^(http|https|ftp|mailto|tel):/", $location)) $location = "error-xss-filter";
}
return $location;
}
@ -2298,7 +2298,7 @@ class YellowLookup {
if (!preg_match("/^\w+:/", $location)) {
$url = "$scheme://$address$base$location";
} else {
if ($filterStrict && !preg_match("/^(http|https|ftp|mailto):/", $location)) $location = "error-xss-filter";
if ($filterStrict && !preg_match("/^(http|https|ftp|mailto|tel):/", $location)) $location = "error-xss-filter";
$url = $location;
}
return $url;
@ -3429,11 +3429,11 @@ class YellowToolbox {
}
if ($filterStrict) {
$href = isset($elementAttributes["href"]) ? $elementAttributes["href"] : "";
if (preg_match("/^\w+:/", $href) && !preg_match("/^(http|https|ftp|mailto):/", $href)) {
if (preg_match("/^\w+:/", $href) && !preg_match("/^(http|https|ftp|mailto|tel):/", $href)) {
$elementAttributes["href"] = "error-xss-filter";
}
$href = isset($elementAttributes["xlink:href"]) ? $elementAttributes["xlink:href"] : "";
if (preg_match("/^\w+:/", $href) && !preg_match("/^(http|https|ftp|mailto):/", $href)) {
if (preg_match("/^\w+:/", $href) && !preg_match("/^(http|https|ftp|mailto|tel):/", $href)) {
$elementAttributes["xlink:href"] = "error-xss-filter";
}
}