Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Absolute fallback url in links #467

Open
ReedBe opened this issue Jun 5, 2023 · 0 comments
Open

Absolute fallback url in links #467

ReedBe opened this issue Jun 5, 2023 · 0 comments
Labels

Comments

@ReedBe
Copy link

ReedBe commented Jun 5, 2023

Description

When a link is created in a Redactor field, a "reference tag" containing a fallback URL is saved in the database. For example: {entry:12@1:url||http://localhost:5000/test}

The problem arises when the referenced entry is subsequently deleted. In such cases, the URL stored within the reference tag can be incorrect or potentially dangerous. This poses a security risk, especially when content is encoded in a staging environment and then transferred to production, as the staging URL may be exposed.

Steps to reproduce

  1. In a staging environnement, create a link in a Redactor field, referencing a valid entry.
  2. Deploy this database in production.
  3. Delete the referenced entry.
  4. The link output the fallback url with staging url instead of production url.

Proposed Solution

Consider using relative URLs instead of absolute URLs for fallback when linking to Entries or Assets.
Or add a config to disable fallbacks

@ReedBe ReedBe added the bug label Jun 5, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant