From 4efba18f8688431fae58ae1b826b80f95957aec8 Mon Sep 17 00:00:00 2001 From: Lukas Fleischer Date: Sun, 5 Nov 2017 08:48:25 +0100 Subject: Only allow valid HTTP(s) URLs as home page The home page specified in the account settings is converted to a clickable link on the user's profile. Make sure it is a valid URL which uses the http or https scheme. Signed-off-by: Lukas Fleischer --- web/lib/acctfuncs.inc.php | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'web/lib/acctfuncs.inc.php') diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index bdcaaa82..b8d9dc54 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -162,6 +162,10 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$P="",$C="" $error = __("The email address is invalid."); } + if (!$error && !valid_homepage($HP)) { + $error = __("The home page is invalid, please specify the full HTTP(s) URL."); + } + if (!$error && $K != '' && !valid_pgp_fingerprint($K)) { $error = __("The PGP key fingerprint is invalid."); } -- cgit v1.2.3-24-g4f1b