mirror of
https://github.com/silverstripe/silverstripe-cms
synced 2024-10-22 08:05:56 +02:00
Merge tag '3.4.6' into 3.4
Release 3.4.6
This commit is contained in:
commit
df95066e50
@ -409,11 +409,7 @@ class CMSPageHistoryController extends CMSMain {
|
||||
"ID" => $id,
|
||||
"Version" => $fromVersion,
|
||||
));
|
||||
|
||||
foreach($form->Fields()->dataFields() as $field) {
|
||||
$field->dontEscape = true;
|
||||
}
|
||||
|
||||
|
||||
return $form;
|
||||
}
|
||||
|
||||
|
@ -106,13 +106,23 @@ class RedirectorPage extends Page {
|
||||
public function onBeforeWrite() {
|
||||
parent::onBeforeWrite();
|
||||
|
||||
// Prefix the URL with "http://" if no prefix is found
|
||||
if(
|
||||
$this->ExternalURL
|
||||
&& !parse_url($this->ExternalURL, PHP_URL_SCHEME)
|
||||
&& !preg_match('#^//#', $this->ExternalURL)
|
||||
) {
|
||||
$this->ExternalURL = 'http://' . $this->ExternalURL;
|
||||
if ($this->ExternalURL && substr($this->ExternalURL, 0, 2) !== '//') {
|
||||
$urlParts = parse_url($this->ExternalURL);
|
||||
if ($urlParts) {
|
||||
if (empty($urlParts['scheme'])) {
|
||||
// no scheme, assume http
|
||||
$this->ExternalURL = 'http://' . $this->ExternalURL;
|
||||
} elseif (!in_array($urlParts['scheme'], array(
|
||||
'http',
|
||||
'https',
|
||||
))) {
|
||||
// we only allow http(s) urls
|
||||
$this->ExternalURL = '';
|
||||
}
|
||||
} else {
|
||||
// malformed URL to reject
|
||||
$this->ExternalURL = '';
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
@ -80,6 +80,17 @@ class RedirectorPageTest extends FunctionalTest {
|
||||
RedirectorPage_Controller::remove_extension('RedirectorPageTest_RedirectExtension');
|
||||
}
|
||||
|
||||
public function testNoJSLinksAllowed()
|
||||
{
|
||||
$page = new RedirectorPage();
|
||||
$js = 'javascript:alert("hello world")';
|
||||
$page->ExternalURL = $js;
|
||||
$this->assertEquals($js, $page->ExternalURL);
|
||||
|
||||
$page->write();
|
||||
$this->assertEmpty($page->ExternalURL);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
class RedirectorPageTest_RedirectExtension extends Extension implements TestOnly {
|
||||
|
Loading…
Reference in New Issue
Block a user