mirror of
https://github.com/silverstripe/silverstripe-iframe
synced 2024-10-22 11:05:51 +02:00
Compare commits
2 Commits
d33a9d52e3
...
e6a0f2dc34
Author | SHA1 | Date | |
---|---|---|---|
|
e6a0f2dc34 | ||
|
8dfd9ce148 |
@ -3,12 +3,13 @@
|
||||
namespace SilverStripe\IFrame;
|
||||
|
||||
use Page;
|
||||
use SilverStripe\Core\Validation\ConstraintValidator;
|
||||
use SilverStripe\Forms\DropdownField;
|
||||
use SilverStripe\Forms\FieldList;
|
||||
use SilverStripe\Forms\TextField;
|
||||
use SilverStripe\ORM\FieldType\DBField;
|
||||
use SilverStripe\ORM\ValidationException;
|
||||
use SilverStripe\ORM\ValidationResult;
|
||||
use SilverStripe\Core\Validation\ValidationResult;
|
||||
use Symfony\Component\Validator\Constraints\Url;
|
||||
|
||||
/**
|
||||
* Iframe page type embeds an iframe of URL of choice into the page.
|
||||
@ -119,21 +120,21 @@ class IFramePage extends Page
|
||||
/**
|
||||
* Ensure that the IFrameURL is a valid url and prevents XSS
|
||||
*
|
||||
* @throws ValidationException
|
||||
* @return ValidationResult
|
||||
*/
|
||||
public function validate()
|
||||
{
|
||||
$result = parent::validate();
|
||||
$fullResult = parent::validate();
|
||||
|
||||
//whitelist allowed URL schemes
|
||||
$allowed_schemes = array('http', 'https');
|
||||
if ($matches = parse_url($this->IFrameURL ?? '')) {
|
||||
if (isset($matches['scheme']) && !in_array($matches['scheme'], $allowed_schemes ?? [])) {
|
||||
$result->addError(_t(__CLASS__ . '.VALIDATION_BANNEDURLSCHEME', "This URL scheme is not allowed."));
|
||||
}
|
||||
}
|
||||
$allowedSchemes = ['http', 'https'];
|
||||
$message = _t(__CLASS__ . '.VALIDATION_URL', 'Please enter a valid URL');
|
||||
$result = ConstraintValidator::validate(
|
||||
$this->value,
|
||||
new Url(message: $message, protocols: $allowedSchemes),
|
||||
$this->getName()
|
||||
);
|
||||
$fullResult->combineAnd($result);
|
||||
|
||||
return $result;
|
||||
return $fullResult;
|
||||
}
|
||||
}
|
||||
|
@ -4,7 +4,7 @@ namespace SilverStripe\IFrame\Tests;
|
||||
|
||||
use SilverStripe\Core\Config\Config;
|
||||
use SilverStripe\Control\Director;
|
||||
use SilverStripe\ORM\ValidationException;
|
||||
use SilverStripe\Core\Validation\ValidationException;
|
||||
use SilverStripe\Dev\SapphireTest;
|
||||
use SilverStripe\IFrame\IFramePage;
|
||||
use SilverStripe\IFrame\IFramePageController;
|
||||
|
Loading…
Reference in New Issue
Block a user