Fixes #3747. Using filter_var to check for any valid URI.

diff --git a/engine/lib/output.php b/engine/lib/output.php
index 2c3e1a0ba19637311bc82e32c11728dbce1369cf..37ebbb4aa1bc088746a70bf0fc79e7a5f1741700 100644 (file)
--- a/engine/lib/output.php
+++ b/engine/lib/output.php
@@ -243,13 +243,32 @@ function elgg_clean_vars(array $vars = array()) {
  * @return string The absolute url
  */
 function elgg_normalize_url($url) {
-       // 'http://example.com', 'https://example.com', '//example.com'
-       // '#target', '?query=string'
-       if (preg_match("#^(\#|\?|(https?:)?//)#i", $url)) {
+       // see https://bugs.php.net/bug.php?id=51192
+       // from the bookmarks save action.
+       $php_5_2_13_and_below = version_compare(PHP_VERSION, '5.2.14', '<');
+       $php_5_3_0_to_5_3_2 = version_compare(PHP_VERSION, '5.3.0', '>=') &&
+                       version_compare(PHP_VERSION, '5.3.3', '<');
+
+       $validated = false;
+       if ($php_5_2_13_and_below || $php_5_3_0_to_5_3_2) {
+               $tmp_address = str_replace("-", "", $url);
+               $validated = filter_var($tmp_address, FILTER_VALIDATE_URL);
+       } else {
+               $validated = filter_var($url, FILTER_VALIDATE_URL);
+       }
+
+       if ($validated) {
+               // all normal URLs including mailto:
                return $url;
 
+       } elseif (preg_match("#^(\#|\?|//)#i", $url)) {
+               // '//example.com' (Shortcut for protocol.)
+               // '?query=test', #target
+               return $url;
+       
        } elseif (stripos($url, 'javascript:') === 0) {
                // 'javascript:'
+               // Not covered in FILTER_VALIDATE_URL
                return $url;
 
        } elseif (preg_match("#^[^/]*\.php(\?.*)?$#i", $url)) {

diff --git a/engine/tests/api/helpers.php b/engine/tests/api/helpers.php
index 439d5aa4683d4e69593ccb5cb210b3547b6b669f..f48f91faf8e613bc4dd2beccdc03adc08c42e133 100644 (file)
--- a/engine/tests/api/helpers.php
+++ b/engine/tests/api/helpers.php
@@ -74,7 +74,13 @@ class ElggCoreHelpersTest extends ElggCoreUnitTest {
                $conversions = array(
                        'http://example.com' => 'http://example.com',
                        'https://example.com' => 'https://example.com',
+                       'http://example-time.com' => 'http://example-time.com',
+
                        '//example.com' => '//example.com',
+                       'ftp://example.com/file' => 'ftp://example.com/file',
+                       'mailto:brett@elgg.org' => 'mailto:brett@elgg.org',
+                       'javascript:alert("test")' => 'javascript:alert("test")',
+                       'app://endpoint' => 'app://endpoint',
 
                        'example.com' => 'http://example.com',
                        'example.com/subpage' => 'http://example.com/subpage',