Forbid javascript scheme

glpi-project · Jun 20, 2019 · 081338b · 081338b
1 parent b4ed40a
commit 081338b
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/inc/html.class.php b/inc/html.class.php
@@ -91,6 +91,7 @@ static function clean($value, $striptags = true, $keep_bad = 2) {
             'comment'          => 1, // 1: remove
             'cdata'            => 1, // 1: remove
             'direct_list_nest' => 1, // 1: Allow usage of ul/ol tags nested in other ul/ol tags
+            'schemes'          => 'aim, app, feed, file, ftp, gopher, http, https, !javascript, irc, mailto, news, nntp, sftp, ssh, tel, telnet'
          ]
       );