diff --git a/NEWS b/NEWS index 7f05908a..1a57d65c 100644 --- a/NEWS +++ b/NEWS @@ -24,6 +24,8 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier !
http://www.google.com/url?q=%s
). '.
+ 'This prevents PageRank leaks, while being as transparent as possible '.
+ 'to users (you may also want to add some client side JavaScript to '.
+ 'override the text in the statusbar). Warning: many security experts '.
+ 'believe that this form of protection does not deter spam-bots. '.
+ 'You can also use this directive to redirect users to a splash page '.
+ 'telling them they are leaving your website. '.
+ 'This directive has been available since 1.3.0.'
+);
+
/**
* Validates a URI as defined by RFC 3986.
* @note Scheme-specific mechanics deferred to HTMLPurifier_URIScheme
@@ -225,6 +240,14 @@ class HTMLPurifier_AttrDef_URI extends HTMLPurifier_AttrDef
if ($query !== null) $result .= "?$query";
if ($fragment !== null) $result .= "#$fragment";
+ // munge if necessary
+ $munge = $config->get('URI', 'Munge');
+ if (!empty($scheme_obj->browsable) && $munge !== null) {
+ if ($authority !== null) {
+ $result = str_replace('%s', rawurlencode($result), $munge);
+ }
+ }
+
return $result;
}
diff --git a/tests/HTMLPurifier/AttrDef/URITest.php b/tests/HTMLPurifier/AttrDef/URITest.php
index 4be0e855..f321ee04 100644
--- a/tests/HTMLPurifier/AttrDef/URITest.php
+++ b/tests/HTMLPurifier/AttrDef/URITest.php
@@ -285,6 +285,21 @@ class HTMLPurifier_AttrDef_URITest extends HTMLPurifier_AttrDefHarness
}
+ function testMunge() {
+
+ $this->config->set('URI', 'Munge', 'http://www.google.com/url?q=%s');
+ $this->def = new HTMLPurifier_AttrDef_URI();
+
+ $this->assertDef(
+ 'http://www.example.com/',
+ 'http://www.google.com/url?q=http%3A%2F%2Fwww.example.com%2F'
+ );
+
+ $this->assertDef('index.html');
+ $this->assertDef('javascript:foobar();', false);
+
+ }
+
}
?>
\ No newline at end of file