sergiotarxz
/
Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Editor: Prevent adding `javascript:` and `data:` URLs through the inline link dialog. 

Merge of [41393] to the 4.7 branch.


git-svn-id: https://develop.svn.wordpress.org/branches/4.7@41401 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Dominik Schilling (ocean90) 2017-09-19 10:14:45 +00:00
parent 597a88861b
commit dd44bf6b4c
2 changed files with 23 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/wp-includes/js/tinymce/plugins/wplink/plugin.js
View File

@ -4,7 +4,7 @@
renderHtml: function() {
return (
'<div id="' + this._id + '" class="wp-link-preview">' +
'<a href="' + this.url + '" target="_blank" tabindex="-1">' + this.url + '</a>' +
'<a href="' + this.url + '" target="_blank" rel="noopener" tabindex="-1">' + this.url + '</a>' +
'</div>'
);
},
@ -249,6 +249,13 @@
text = inputInstance.getLinkText();
editor.focus();
var parser = document.createElement( 'a' );
parser.href = href;
if ( 'javascript:' === parser.protocol || 'data:' === parser.protocol ) { // jshint ignore:line
href = '';
}
if ( ! href ) {
editor.dom.remove( linkNode, true );
return;

16
src/wp-includes/js/wplink.js
View File

@ -312,7 +312,7 @@ var wpLink;
var html = '<a href="' + attrs.href + '"';
if ( attrs.target ) {
html += ' target="' + attrs.target + '"';
html += ' rel="noopener" target="' + attrs.target + '"';
}
return html + '>';
@ -337,6 +337,13 @@ var wpLink;
attrs = wpLink.getAttrs();
text = inputs.text.val();
var parser = document.createElement( 'a' );
parser.href = attrs.href;
if ( 'javascript:' === parser.protocol || 'data:' === parser.protocol ) { // jshint ignore:line
attrs.href = '';
}
// If there's no href, return.
if ( ! attrs.href ) {
return;
@ -389,6 +396,13 @@ var wpLink;
var attrs = wpLink.getAttrs(),
$link, text, hasText, $mceCaret;
var parser = document.createElement( 'a' );
parser.href = attrs.href;
if ( 'javascript:' === parser.protocol || 'data:' === parser.protocol ) { // jshint ignore:line
attrs.href = '';
}
if ( ! attrs.href ) {
editor.execCommand( 'unlink' );
wpLink.close();