only allow configured URL schemes in external links
This fixes a problem where JavaScript could be introduced through specially crafted RSS feeds on a lower level than the commit from yesterday (1ca
only allow configured URL schemes in external links
This fixes a problem where JavaScript could be introduced through specially crafted RSS feeds on a lower level than the commit from yesterday (1ca2719c7488662ebd7964c0d026e0890f923ee9)
This also fixes a problem where JavaScript links could be introduced by specifying it as an RSS URL: the resulting error message displays a link to the broken feed URL. This patch makes sure there's no working link for unknown protocols.
show more ...
|