tyler.durden/icingaweb2
1
0
Fork 0
mirror of https://github.com/Icinga/icingaweb2.git synced 2025-07-29 08:44:10 +02:00
Code Issues Packages Projects Releases Wiki Activity

LinkTransformer: Don't load any external url in an iframe

Browse Source
This commit is contained in:
Johannes Meyer 2022-02-04 12:48:35 +01:00
parent baf2f1bbde
commit 6b0f3f69c3
1 changed files with 4 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
library/Icinga/Web/Helper/Markdown/LinkTransformer.php
View File

@ -9,21 +9,6 @@ use ipl\Web\Url;
class LinkTransformer extends HTMLPurifier_AttrTransform class LinkTransformer extends HTMLPurifier_AttrTransform
{ {
/**
* Link targets with such a file extension are not loaded by an iFrame
*
* @var string[]
*/
public static $NON_IFRAME_FILES = [
'html',
'htm',
'php',
'svg',
'aspx',
'cshtml',
'vbhtml'
];
/** /**
* Link targets that are considered to have a thumbnail * Link targets that are considered to have a thumbnail
* *
@ -55,19 +40,17 @@ class LinkTransformer extends HTMLPurifier_AttrTransform
} }
$hasThumbnail = $ext !== null && in_array($ext, static::$IMAGE_FILES, true); $hasThumbnail = $ext !== null && in_array($ext, static::$IMAGE_FILES, true);
$useIframe = $ext !== null && ! in_array($ext, static::$NON_IFRAME_FILES, true);
if ($hasThumbnail) { if ($hasThumbnail) {
// I would have liked to not only base this off of the extension, but also by // I would have liked to not only base this off of the extension, but also by
// whether there is an actual img tag inside the anchor. Seems not possible :( // whether there is an actual img tag inside the anchor. Seems not possible :(
$attr['class'] = 'with-thumbnail'; $attr['class'] = 'with-thumbnail';
} }
if ((! isset($attr['target']) || ! in_array($attr['target'], ['_blank', '_self']))) { if (! isset($attr['target'])) {
if ($useIframe) { if ($url->isExternal()) {
$attr['href'] = Url::fromPath('iframe', ['url' => $url])->getAbsoluteUrl();
} elseif ($url->isExternal()) {
$attr['target'] = '_blank'; $attr['target'] = '_blank';
} else {
$attr['data-base-target'] = '_next';
} }
} }