Wavyzz/dolibarr
2
0
Fork 1
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-12-09 19:18:22 +01:00
Code Issues Packages Projects Releases Wiki Activity

Start to intrroduce type "restricthtmlnolink"

Browse Source
This commit is contained in:
Laurent Destailleur
2023-02-13 19:48:04 +01:00
parent 83727d08ba
commit f5adef1ffb
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
htdocs/core/lib/functions.lib.php
View File

@@ -952,6 +952,7 @@ function sanitizeVal($out = '', $check = 'alphanohtml', $filter = null, $options
}
break;
case 'restricthtml': // Recommended for most html textarea
case 'restricthtmlnolink':
case 'restricthtmlallowunvalid':
$out = dol_htmlwithnojs($out, 1, $check);
break;
@@ -7201,7 +7202,7 @@ function dol_nl2br($stringtoencode, $nl2brmode = 0, $forxml = false)
*
* @param string $stringtoencode String to encode
* @param int $nouseofiframesandbox Allow use of option MAIN_SECURITY_USE_SANDBOX_FOR_HTMLWITHNOJS for html sanitizing
* @param string $check 'restricthtml' or 'restricthtmlallowunvalid'
* @param string $check 'restricthtmlnolink' or 'restricthtml' or 'restricthtmlallowunvalid'
* @return string HTML sanitized
*/
function dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox = 0, $check = 'restricthtml')
@@ -7274,9 +7275,16 @@ function dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox = 0, $check = '
// Check the limit of external links in a Rich text content. We count '<img' and 'url('
$reg = array();
preg_match_all('/(<img|url\()/i', $out, $reg);
if (count($reg[0]) > getDolGlobalInt("MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT", 1000)) {
$nbextlink = count($reg[0]);
if ($nbextlink > getDolGlobalInt("MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT", 1000)) {
$out = 'TooManyLinksIntoHTMLString';
}
//
if (!empty($conf->global->MAIN_DISALLOW_EXT_URL_INTO_DESCRIPTIONS) || $check == 'restricthtmlnolink') {
if ($nbextlink > 0) {
$out = 'ExternalLinksNotAllowed';
}
}
return $out;
}