aboutsummaryrefslogtreecommitdiffstats
path: root/include
diff options
context:
space:
mode:
authorfriendica <info@friendica.com>2014-02-20 21:15:35 -0800
committerfriendica <info@friendica.com>2014-02-20 21:15:35 -0800
commit44d7047fce57085fe63ad5e1088911e9fc07a32e (patch)
tree078e9d4b634d583de8359ddae94c69d86ec19d17 /include
parent9db40322abaccd036a71252633f755ad46064798 (diff)
downloadvolse-hubzilla-44d7047fce57085fe63ad5e1088911e9fc07a32e.tar.gz
volse-hubzilla-44d7047fce57085fe63ad5e1088911e9fc07a32e.tar.bz2
volse-hubzilla-44d7047fce57085fe63ad5e1088911e9fc07a32e.zip
SECURITY: do not automatically open an iframe which points into the local website.
Diffstat (limited to 'include')
-rw-r--r--include/bbcode.php9
1 files changed, 8 insertions, 1 deletions
diff --git a/include/bbcode.php b/include/bbcode.php
index 1969f8444..8bbf7ae01 100644
--- a/include/bbcode.php
+++ b/include/bbcode.php
@@ -227,6 +227,13 @@ function bb_location($match) {
// not yet implemented
}
+function bbiframe($match) {
+ $a = get_app();
+ if(strpos($match[1],get_app()->get_hostname()))
+ return '<a href="' . $match[1] . '">' . $match[1] . '</a>';
+ return '<iframe src="' . $match[1] . '" width="' . $a->videowidth . '" height="' . $a->videoheight . '"><a href="' . $match[1] . '">' . $match[1] . '</a></iframe>';
+}
+
function bb_ShareAttributesSimple($match) {
$attributes = $match[1];
@@ -677,7 +684,7 @@ function bbcode($Text,$preserve_nl = false, $tryoembed = true) {
if ($tryoembed){
if (strpos($Text,'[/iframe]') !== false) {
- $Text = preg_replace("/\[iframe\](.*?)\[\/iframe\]/ism", '<iframe src="$1" width="' . $a->videowidth . '" height="' . $a->videoheight . '"><a href="$1">$1</a></iframe>', $Text);
+ $Text = preg_replace_callback("/\[iframe\](.*?)\[\/iframe\]/ism", 'bbiframe', $Text);
}
}
else {