search

FriendsOfFlarum / socialprofile

Add custom social media pages to your user profile
MIT License
13 stars 8 forks source link

Detect XSS URL with its prefix #11

Closed supersonictw closed 3 years ago

supersonictw commented 3 years ago

Please PR it, prevent from the malicious code executed and caused the users of Flarum getting the danger.

karaok491 commented 3 years ago

Hi, and thanks for the PR!

Whilst I think this is a very good call to block javascript: from being entered in these fields, I'd question if this is the most sensible approach?

I think that by validating the url on save, would make more sense here, rather than allowing it into the database in the first place.

supersonictw commented 3 years ago

I think that the issue https://github.com/FriendsOfFlarum/socialprofile/issues/13 already resolved this problem. I'm still learning the Flarum PHP API but not professional enough, so I modified the JavaScript instead, thank you for your updates.