Fixes #4190 accepting full urls with non-ascii characters

diff --git a/engine/lib/output.php b/engine/lib/output.php
index 989eca60edcb72122587a512b2aba23f0095e4e1..6554481f5b3d5b6d8516994bbd5b33a89a0f8064 100644 (file)
--- a/engine/lib/output.php
+++ b/engine/lib/output.php
@@ -234,7 +234,7 @@ function elgg_clean_vars(array $vars = array()) {
  *
  * @example
  * elgg_normalize_url('');                   // 'http://my.site.com/'
- * elgg_normalize_url('dashboard');       // 'http://my.site.com/dashboard'
+ * elgg_normalize_url('dashboard');          // 'http://my.site.com/dashboard'
  * elgg_normalize_url('http://google.com/'); // no change
  * elgg_normalize_url('//google.com/');      // no change
  *
@@ -257,6 +257,11 @@ function elgg_normalize_url($url) {
                $validated = filter_var($url, FILTER_VALIDATE_URL);
        }
 
+       // work around for handling absoluate IRIs (RFC 3987) - see #4190
+       if (!$validated && (strpos($url, 'http:') === 0) || (strpos($url, 'https:') === 0)) {
+               $validated = true;
+       }
+
        if ($validated) {
                // all normal URLs including mailto:
                return $url;