Changeset 30529

Timestamp:

2016-05-12T16:48:10+12:00 (8 years ago)

Author:

ak19

Message:

Implementing Dr Bainbridge's solution to fix the external link I'd broken in order to make external links safe/secure from XSS.

Location:

main/trunk/greenstone2/macros

Files:

• english2.dm (modified) (2 diffs)
• extlink.dm (modified) (1 diff)

main/trunk/greenstone2/macros/english2.dm

@@ -154 +154 @@
 _textextlinkcontent_ {The link you have selected is external to any of your currently selected collections.
     If you still wish to view this link and your browser has access to 
-    the Web, you can <a href="_nexturl_">go forward</a> to this page; otherwise 
-    use your browsers "back" button to return to the previous document.}
+    the Web, you can <a href="_nexturl_" onClick="follow\_escaped\_link(event, this.href)">go forward</a> to this page; otherwise 
+    use your browser's "back" button to return to the previous document.}
 
 _textlinknotfoundcontent_ {For reasons beyond our control, the internal link you have selected 
@@ -170 +170 @@
     If you wish to view this link in the "_2_" collection you can 
     <a href="_httpdoc_&amp;c=_1_&amp;cl=_cgiargclUrlsafe_&amp;d=_3_">go forward</a> to this page; 
-    otherwise use your browsers "back" button to return to the previous document.
+    otherwise use your browser's "back" button to return to the previous document.
 }
 

main/trunk/greenstone2/macros/extlink.dm

@@ -1 +1 @@
 # this file must be UTF-8 encoded
 
+# If there are external links, call this function
+_extlinkscript_ {
+
+function follow_escaped_link (event, the_url) \{
+  //http://stackoverflow.com/questions/8614438/preventdefault-inside-onclick-attribute-of-a-tag
+  event.preventDefault();  
+
+  //http://stackoverflow.com/questions/747641/what-is-the-difference-between-decodeuricomponent-and-decodeuri
+  the_url = decodeURIComponent(the_url);
+  var lastIndex = the_url.lastIndexOf("http://");
+  if(the_url.indexOf("http://") !== lastIndex) \{
+    the_url = the_url.substring(lastIndex);
+  \}
+  location.href = the_url;
+  
+\}
+
+}
+
 package extlink
+
+# override this to include _extlinkscript_
+_globalscripts_{
+<script language="javascript" type="text/javascript">
+_extlinkscript_
+</script>
+
+}
 
 _header_ {_htmlhead_}