gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Extend PMA_checkLink to cover more use cases

Browse Source 
- allow to support mailto, ftp or http links on request
- do not use multibyte functions as we're interested in first chars
  anyway and we're comparing against ascii ones

Issue #12479

Signed-off-by: Michal Čihař <michal@cihar.com>
This commit is contained in:
Michal Čihař 2016-08-24 11:28:25 +02:00
parent 4a9b84faa2
commit 265efb046f
1 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
libraries/sanitizing.lib.php
View File

@ -9,23 +9,33 @@
/**
* Checks whether given link is valid
*
* @param string $url URL to check
* @param string $url URL to check
* @param boolean $http Whether to allow http links
* @param boolean $other Whether to allow ftp and mailto links
*
* @return boolean True if string can be used as link
*/
function PMA_checkLink($url)
function PMA_checkLink($url, $http=false, $other=false)
{
$url = strtolower($url);
$valid_starts = array(
'https://',
'./url.php?url=https%3A%2F%2F',
'./url.php?url=https%3a%2f%2f',
'./doc/html/',
);
if ($other) {
$valid_starts[] = 'mailto:';
$valid_starts[] = 'ftp://';
}
if ($http) {
$valid_starts[] = 'http://';
}
if (defined('PMA_SETUP')) {
$valid_starts[] = '?page=form&';
$valid_starts[] = '?page=servers&';
}
foreach ($valid_starts as $val) {
if (mb_substr($url, 0, mb_strlen($val)) == $val) {
if (substr($url, 0, strlen($val)) == $val) {
return true;
}
}