This module filters out urls like background-image: url(http://example.com/image.jpg) no matter what you put in the "allowed URLs" box, because it tosses out anything with a non-standard protocol, and url(http isn't an allowed protocol. Since this module has it's own xss protocol filter, I patched this bug by allowing the protocols 'url(http', 'url("http', 'url(https', and 'url("https'.

CommentFileSizeAuthor
#1 wysiwyg_filter-363284-1.patch1.59 KBmarkus_petrux
fix_url_removed_by_xss_bad_protocol.patch1.14 KBjamuraa

Comments

markus_petrux’s picture

markus_petrux commented
StatusFileSize
new wysiwyg_filter-363284-1.patch1.59 KB

Would you mind trying this one?

Function wysiwyg_filter_xss_bad_protocol() is not altered, but the caller is fixed instead.

jamuraa’s picture

jamuraa commented

This patch tests fine for me as well, and is the correct way to solve this issue, I should have done it this way.

markus_petrux’s picture

markus_petrux commented
Status: Needs review » Reviewed & tested by the community

I'll commit this as soon as possible. Thanks

markus_petrux’s picture

markus_petrux commented
Status: Reviewed & tested by the community » Fixed

Fixed in CVS.

markus_petrux’s picture

markus_petrux commented
Status: Fixed » Closed (fixed)