vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Debug v19 and option MAIN_DISALLOW_URL_INTO_DESCRIPTIONS

Browse source
This commit is contained in:
Laurent Destailleur 2023-11-14 01:32:42 +01:00
parent ca3f5eaadf
commit 804ee3b517
2 changed files with 9 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
htdocs/core/class/doleditor.class.php
View file

@ -173,6 +173,9 @@ class DolEditor
if (empty($conf->global->FCKEDITOR_ENABLE_PDF)) {
$pluginstodisable .= ',exportpdf';
}
if (!empty($conf->global->MAIN_DISALLOW_URL_INTO_DESCRIPTIONS)) {
$this->uselocalbrowser = 0; // Can't use browser to navigate into files. Only links with "<img src=data:..." are allowed.
}
$scaytautostartup = '';
if (!empty($conf->global->FCKEDITOR_ENABLE_SCAYT_AUTOSTARTUP)) {
$scaytautostartup = 'scayt_autoStartup: true,';

11
htdocs/core/lib/functions.lib.php
View file

@ -7635,18 +7635,19 @@ function dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox = 0, $check = '
} while ($oldstringtoclean != $out);
// Check the limit of external links that are automatically executed in a Rich text content. We count:
// '<img' to avoid <img src="http...">
// '<img' to avoid <img src="http...">, we can only accept "<img src="data:..."
// 'url(' to avoid inline style like background: url(http...
// '<link' to avoid <link href="http...">
$reg = array();
preg_match_all('/(<img|url\(|<link)/i', $out, $reg);
$nbextlink = count($reg[0]);
if ($nbextlink > getDolGlobalInt("MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT", 1000)) {
$tmpout = preg_replace('/<img src="data:/mi', '<__IMG_SRC_DATA__ src="data:', $out);
preg_match_all('/(<img|url\(|<link)/i', $tmpout, $reg);
$nblinks = count($reg[0]);
if ($nblinks > getDolGlobalInt("MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT", 1000)) {
$out = 'ErrorTooManyLinksIntoHTMLString';
}
//
if (!empty($conf->global->MAIN_DISALLOW_URL_INTO_DESCRIPTIONS) || $check == 'restricthtmlnolink') {
if ($nbextlink > 0) {
if ($nblinks > 0) {
$out = 'ErrorHTMLLinksNotAllowed';
}
}