We are no longer offering accounts on this server. Consider https://gitlab.freedesktop.org/ as a place to host projects.

Commit 39b5e08d authored by mattl's avatar mattl

Possible XSS scenario when posting Bookmarks

parent 048af5ac
......@@ -134,6 +134,10 @@ class Bookmark extends Managed_DataObject
static function saveNew($profile, $title, $url, $rawtags, $description,
$options=null)
{
if (!common_valid_http_url($url)) {
throw new ClientException(_m('Only web bookmarks can be posted (HTTP or HTTPS).'));
}
$nb = self::getByURL($profile, $url);
if (!empty($nb)) {
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment