From 4efba18f8688431fae58ae1b826b80f95957aec8 Mon Sep 17 00:00:00 2001 From: Lukas Fleischer Date: Sun, 5 Nov 2017 08:48:25 +0100 Subject: Only allow valid HTTP(s) URLs as home page The home page specified in the account settings is converted to a clickable link on the user's profile. Make sure it is a valid URL which uses the http or https scheme. Signed-off-by: Lukas Fleischer --- web/lib/aur.inc.php | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) (limited to 'web/lib/aur.inc.php') diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php index 6cd04515..feb4006b 100644 --- a/web/lib/aur.inc.php +++ b/web/lib/aur.inc.php @@ -150,6 +150,26 @@ function valid_email($addy) { return true; } +/** + * Verify that a given URL is valid and uses the HTTP(s) protocol + * + * @param string $url URL of the home page to be validated + * + * @return bool True if URL passes validity checks, false otherwise + */ +function valid_homepage($url) { + if (filter_var($url, FILTER_VALIDATE_URL) === false) { + return false; + } + + $url_components = parse_url($url); + if (!in_array($url_components['scheme'], array('http', 'https'))) { + return false; + } + + return true; +} + /** * Generate a unique session ID * -- cgit v1.2.3-24-g4f1b