mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-04-14 12:52:08 +02:00
Code Issues Releases Wiki Activity

Merge pull request #60 from phpbb/ticket/security/257

Browse Source 
[ticket/security/257] Enforce http(s) for URLs in image BBCode
This commit is contained in:
Marc Alexander 2020-07-25 11:16:04 +02:00
commit 8e5a635bfb
No known key found for this signature in database
GPG Key ID: 50E0D2423696F995
3 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
phpBB/includes/message_parser.php
View File

@ -390,7 +390,7 @@ class bbcode_firstpass extends bbcode
$in = str_replace(' ', '%20', $in);
// Checking urls
if (!preg_match('#^' . get_preg_expression('url') . '$#iu', $in) && !preg_match('#^' . get_preg_expression('www_url') . '$#iu', $in))
if (!preg_match('#^' . get_preg_expression('url_http') . '$#iu', $in) && !preg_match('#^' . get_preg_expression('www_url') . '$#iu', $in))
{
return '[img]' . $in . '[/img]';
}

5
tests/bbcode/parser_test.php
View File

@ -120,6 +120,11 @@ class phpbb_bbcode_parser_test extends \phpbb_test_case
'[img]https://area51.phpbb.com/images/area51.png[/img]',
'[img:]https://area51.phpbb.com/images/area51.png[/img:]',
),
array(
'Test default bbcodes: img with unsupported protocol',
'[img]foo://foo/bar[/img]',
'[img]foo://foo/bar[/img]',
),
array(
'Test default bbcodes: simple url',
'[url]https://area51.phpbb.com/[/url]',

4
tests/text_formatter/s9e/default_formatting_test.php
View File

@ -132,6 +132,10 @@ class phpbb_textformatter_s9e_default_formatting_test extends phpbb_test_case
'[img]https://area51.phpbb.com/images/area51.png[/img]',
'<img src="https://area51.phpbb.com/images/area51.png" class="postimage" alt="Image">'
),
array(
'[img]foo://area51.phpbb.com/images/area51.png[/img]',
'[img]foo://area51.phpbb.com/images/area51.png[/img]'
),
array(
'[url]https://area51.phpbb.com/[/url]',
'<a href="https://area51.phpbb.com/" class="postlink">https://area51.phpbb.com/</a>'