From 265efb046fe50acb8ca277da533911414af177d3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Wed, 24 Aug 2016 11:28:25 +0200 Subject: [PATCH] Extend PMA_checkLink to cover more use cases MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - allow to support mailto, ftp or http links on request - do not use multibyte functions as we're interested in first chars anyway and we're comparing against ascii ones Issue #12479 Signed-off-by: Michal Čihař --- libraries/sanitizing.lib.php | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/libraries/sanitizing.lib.php b/libraries/sanitizing.lib.php index 23e0476379..d97a490401 100644 --- a/libraries/sanitizing.lib.php +++ b/libraries/sanitizing.lib.php @@ -9,23 +9,33 @@ /** * Checks whether given link is valid * - * @param string $url URL to check + * @param string $url URL to check + * @param boolean $http Whether to allow http links + * @param boolean $other Whether to allow ftp and mailto links * * @return boolean True if string can be used as link */ -function PMA_checkLink($url) +function PMA_checkLink($url, $http=false, $other=false) { + $url = strtolower($url); $valid_starts = array( 'https://', - './url.php?url=https%3A%2F%2F', + './url.php?url=https%3a%2f%2f', './doc/html/', ); + if ($other) { + $valid_starts[] = 'mailto:'; + $valid_starts[] = 'ftp://'; + } + if ($http) { + $valid_starts[] = 'http://'; + } if (defined('PMA_SETUP')) { $valid_starts[] = '?page=form&'; $valid_starts[] = '?page=servers&'; } foreach ($valid_starts as $val) { - if (mb_substr($url, 0, mb_strlen($val)) == $val) { + if (substr($url, 0, strlen($val)) == $val) { return true; } }