WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Editor: Prevent adding `javascript:` and `data:` URLs through the inline link dialog. 

Merge of [41393] to the 4.1 branch.

Built from https://develop.svn.wordpress.org/branches/4.1@41407


git-svn-id: http://core.svn.wordpress.org/branches/4.1@41240 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Dominik Schilling 2017-09-19 10:19:51 +00:00
parent 9eb95c11ff
commit 900cd482a4
2 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
wp-includes/js/wplink.js
View File

@ -210,6 +210,13 @@ var wpLink;
attrs = wpLink.getAttrs();
var parser = document.createElement( 'a' );
parser.href = attrs.href;
if ( 'javascript:' === parser.protocol || 'data:' === parser.protocol ) { // jshint ignore:line
attrs.href = '';
}
// If there's no href, return.
if ( ! attrs.href || attrs.href == 'http://' )
return;
@ -223,7 +230,7 @@ var wpLink;
}
if ( attrs.target ) {
html += ' target="' + attrs.target + '"';
html += ' rel="noopener" target="' + attrs.target + '"';
}
html += '>';
@ -275,6 +282,13 @@ var wpLink;
link = editor.dom.getParent( editor.selection.getNode(), 'a[href]' );
var parser = document.createElement( 'a' );
parser.href = attrs.href;
if ( 'javascript:' === parser.protocol || 'data:' === parser.protocol ) { // jshint ignore:line
attrs.href = '';
}
// If the values are empty, unlink and return
if ( ! attrs.href || attrs.href == 'http://' ) {
editor.execCommand( 'unlink' );

2
wp-includes/js/wplink.min.js vendored
View File

File diff suppressed because one or more lines are too long