Only allow valid HTTP(s) URLs as home page

The home page specified in the account settings is converted to a
clickable link on the user's profile. Make sure it is a valid URL which
uses the http or https scheme.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

1 files changed, 20 insertions, 0 deletions

diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php
index 6cd04515..feb4006b 100644
--- a/web/lib/aur.inc.php
+++ b/web/lib/aur.inc.php
@@ -151,6 +151,26 @@ function valid_email($addy) {
 }
 
 /**
+ * Verify that a given URL is valid and uses the HTTP(s) protocol
+ *
+ * @param string $url URL of the home page to be validated
+ *
+ * @return bool True if URL passes validity checks, false otherwise
+ */
+function valid_homepage($url) {
+	if (filter_var($url, FILTER_VALIDATE_URL) === false) {
+		return false;
+	}
+
+	$url_components = parse_url($url);
+	if (!in_array($url_components['scheme'], array('http', 'https'))) {
+		return false;
+	}
+
+	return true;
+}
+
+/**
  * Generate a unique session ID
  *
  * @return string MD5 hash of the concatenated user IP, random number, and current time