diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index e494dfd4bc1..3a2cf652f1c 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -952,6 +952,7 @@ function sanitizeVal($out = '', $check = 'alphanohtml', $filter = null, $options } break; case 'restricthtml': // Recommended for most html textarea + case 'restricthtmlnolink': case 'restricthtmlallowunvalid': $out = dol_htmlwithnojs($out, 1, $check); break; @@ -7201,7 +7202,7 @@ function dol_nl2br($stringtoencode, $nl2brmode = 0, $forxml = false) * * @param string $stringtoencode String to encode * @param int $nouseofiframesandbox Allow use of option MAIN_SECURITY_USE_SANDBOX_FOR_HTMLWITHNOJS for html sanitizing - * @param string $check 'restricthtml' or 'restricthtmlallowunvalid' + * @param string $check 'restricthtmlnolink' or 'restricthtml' or 'restricthtmlallowunvalid' * @return string HTML sanitized */ function dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox = 0, $check = 'restricthtml') @@ -7274,9 +7275,16 @@ function dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox = 0, $check = ' // Check the limit of external links in a Rich text content. We count ' getDolGlobalInt("MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT", 1000)) { + $nbextlink = count($reg[0]); + if ($nbextlink > getDolGlobalInt("MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT", 1000)) { $out = 'TooManyLinksIntoHTMLString'; } + // + if (!empty($conf->global->MAIN_DISALLOW_EXT_URL_INTO_DESCRIPTIONS) || $check == 'restricthtmlnolink') { + if ($nbextlink > 0) { + $out = 'ExternalLinksNotAllowed'; + } + } return $out; }