Upstream/WordPress
1
0
Fork 0
mirror of https://github.com/WordPress/WordPress.git synced 2024-11-16 07:35:39 +01:00
Code Issues Projects Releases Wiki Activity

Editor: Prevent adding javascript: and data: URLs through the inline link dialog.

Browse Source 
Built from https://develop.svn.wordpress.org/trunk@41393


git-svn-id: http://core.svn.wordpress.org/trunk@41226 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Dominik Schilling 2017-09-19 08:01:45 +00:00
parent f6a26be345
commit c2ead9d046
6 changed files with 26 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
wp-includes/js/tinymce/plugins/wplink/plugin.js
View File

@ -4,7 +4,7 @@
renderHtml: function() { renderHtml: function() {
return ( return (
'<div id="' + this._id + '" class="wp-link-preview">' + '<div id="' + this._id + '" class="wp-link-preview">' +
'<a href="' + this.url + '" target="_blank" tabindex="-1">' + this.url + '</a>' + '<a href="' + this.url + '" target="_blank" rel="noopener" tabindex="-1">' + this.url + '</a>' +
'</div>' '</div>'
); );
}, },
@ -249,6 +249,13 @@
text = inputInstance.getLinkText(); text = inputInstance.getLinkText();
editor.focus(); editor.focus();
var parser = document.createElement( 'a' );
parser.href = href;
if ( 'javascript:' === parser.protocol || 'data:' === parser.protocol ) { // jshint ignore:line
href = '';
}
if ( ! href ) { if ( ! href ) {
editor.dom.remove( linkNode, true ); editor.dom.remove( linkNode, true );
return; return;

2
wp-includes/js/tinymce/plugins/wplink/plugin.min.js vendored
View File

File diff suppressed because one or more lines are too long

BIN
wp-includes/js/tinymce/wp-tinymce.js.gz
View File

Binary file not shown.

16
wp-includes/js/wplink.js
View File

@ -312,7 +312,7 @@ var wpLink;
var html = '<a href="' + attrs.href + '"'; var html = '<a href="' + attrs.href + '"';
if ( attrs.target ) { if ( attrs.target ) {
html += ' target="' + attrs.target + '"'; html += ' rel="noopener" target="' + attrs.target + '"';
} }
return html + '>'; return html + '>';
@ -337,6 +337,13 @@ var wpLink;
attrs = wpLink.getAttrs(); attrs = wpLink.getAttrs();
text = inputs.text.val(); text = inputs.text.val();
var parser = document.createElement( 'a' );
parser.href = attrs.href;
if ( 'javascript:' === parser.protocol || 'data:' === parser.protocol ) { // jshint ignore:line
attrs.href = '';
}
// If there's no href, return. // If there's no href, return.
if ( ! attrs.href ) { if ( ! attrs.href ) {
return; return;
@ -390,6 +397,13 @@ var wpLink;
var attrs = wpLink.getAttrs(), var attrs = wpLink.getAttrs(),
$link, text, hasText, $mceCaret; $link, text, hasText, $mceCaret;
var parser = document.createElement( 'a' );
parser.href = attrs.href;
if ( 'javascript:' === parser.protocol || 'data:' === parser.protocol ) { // jshint ignore:line
attrs.href = '';
}
if ( ! attrs.href ) { if ( ! attrs.href ) {
editor.execCommand( 'unlink' ); editor.execCommand( 'unlink' );
wpLink.close(); wpLink.close();

2
wp-includes/js/wplink.min.js vendored
View File

File diff suppressed because one or more lines are too long

2
wp-includes/version.php
View File

@ -4,7 +4,7 @@
* *
* @global string $wp_version * @global string $wp_version
*/ */
$wp_version = '4.9-alpha-41390'; $wp_version = '4.9-alpha-41393';
/** /**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema. * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.