From: Badlop Date: Sat, 21 Feb 2009 09:30:23 +0000 (+0000) Subject: Merge r1879 from trunk: X-Git-Tag: v2.0.5~29 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ad486073270eb4e214bcf9c690d7342ea180ab74;p=ejabberd Merge r1879 from trunk: * src/mod_muc/mod_muc_log.erl: Prevent XSS in MUC logs by linkifying only a few known protocols (EJAB-850) SVN Revision: 1905 --- diff --git a/ChangeLog b/ChangeLog index 9fa9fad22..b64bd1f6d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,8 @@ 2009-02-21 Badlop + * src/mod_muc/mod_muc_log.erl: Prevent XSS in MUC logs by + linkifying only a few known protocols (EJAB-850) + * src/mod_roster.erl: When account is deleted, cancel presence subscription for all roster items (EJAB-790) * src/mod_roster_odbc.erl: Likewise diff --git a/src/mod_muc/mod_muc_log.erl b/src/mod_muc/mod_muc_log.erl index 75aee4d77..1ebff1b2d 100644 --- a/src/mod_muc/mod_muc_log.erl +++ b/src/mod_muc/mod_muc_log.erl @@ -701,7 +701,8 @@ htmlize2(S1, NoFollow) -> S2 = element(2, regexp:gsub(S1, "\\&", "\\&")), S3 = element(2, regexp:gsub(S2, "<", "\\<")), S4 = element(2, regexp:gsub(S3, ">", "\\>")), - S5 = element(2, regexp:gsub(S4, "[-+.a-zA-Z0-9]+://[^] )\'\"}]+", link_regexp(NoFollow))), + S5 = element(2, regexp:gsub(S4, "(http|https|ftp|mailto|xmpp)://[^] )\'\"}]+", + link_regexp(NoFollow))), %% Remove 'right-to-left override' unicode character 0x202e element(2, regexp:gsub(S5, [226,128,174], "[RLO]")).