diff options
author | zotlabs <mike@macgirvin.com> | 2017-03-27 14:11:25 -0700 |
---|---|---|
committer | zotlabs <mike@macgirvin.com> | 2017-03-27 14:11:25 -0700 |
commit | 8292553a2087a412e0b10f5593d461d371169adb (patch) | |
tree | 2648714d80a19154ec19defa92aaa3229cae23c6 /vendor/ezyang/htmlpurifier/library/HTMLPurifier/AttrTransform/TargetNoreferrer.php | |
parent | 5cbf60320355845e2abdec0422055d3fe321e84e (diff) | |
parent | 6375401e0af6c52d151dd2b944aa6a054b8ddc05 (diff) | |
download | volse-hubzilla-8292553a2087a412e0b10f5593d461d371169adb.tar.gz volse-hubzilla-8292553a2087a412e0b10f5593d461d371169adb.tar.bz2 volse-hubzilla-8292553a2087a412e0b10f5593d461d371169adb.zip |
Merge branch 'dev' of https://github.com/redmatrix/hubzilla into xdev_merge
Diffstat (limited to 'vendor/ezyang/htmlpurifier/library/HTMLPurifier/AttrTransform/TargetNoreferrer.php')
-rw-r--r-- | vendor/ezyang/htmlpurifier/library/HTMLPurifier/AttrTransform/TargetNoreferrer.php | 37 |
1 files changed, 37 insertions, 0 deletions
diff --git a/vendor/ezyang/htmlpurifier/library/HTMLPurifier/AttrTransform/TargetNoreferrer.php b/vendor/ezyang/htmlpurifier/library/HTMLPurifier/AttrTransform/TargetNoreferrer.php new file mode 100644 index 000000000..587dc2e07 --- /dev/null +++ b/vendor/ezyang/htmlpurifier/library/HTMLPurifier/AttrTransform/TargetNoreferrer.php @@ -0,0 +1,37 @@ +<?php + +// must be called POST validation + +/** + * Adds rel="noreferrer" to any links which target a different window + * than the current one. This is used to prevent malicious websites + * from silently replacing the original window, which could be used + * to do phishing. + * This transform is controlled by %HTML.TargetNoreferrer. + */ +class HTMLPurifier_AttrTransform_TargetNoreferrer extends HTMLPurifier_AttrTransform +{ + /** + * @param array $attr + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return array + */ + public function transform($attr, $config, $context) + { + if (isset($attr['rel'])) { + $rels = explode(' ', $attr['rel']); + } else { + $rels = array(); + } + if (isset($attr['target']) && !in_array('noreferrer', $rels)) { + $rels[] = 'noreferrer'; + } + if (!empty($rels) || isset($attr['rel'])) { + $attr['rel'] = implode(' ', $rels); + } + + return $attr; + } +} + |