fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-04-17 09:24:17 +09:00
Code Issues Projects Releases Packages Wiki Activity

XEVE-19-001, XEVE-19-003, XEVE-19-006

Browse source 
xpressengine/xe-core@18ec8078eb
This commit is contained in:
Kijin Sung 2019-05-04 17:36:41 +09:00
parent 880ae97e31
commit 70108f858d
9 changed files with 86 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

9
modules/document/document.controller.php
View file

@ -387,7 +387,7 @@ class documentController extends document
if($obj->allow_trackback!='Y') $obj->allow_trackback = 'N';
if($obj->homepage)
{
$obj->homepage = removeHackTag($obj->homepage);
$obj->homepage = escape($obj->homepage);
if(!preg_match('/^[a-z]+:\/\//i',$obj->homepage))
{
$obj->homepage = 'http://'.$obj->homepage;
@ -517,7 +517,10 @@ class documentController extends document
}
// Remove iframe and script if not a top adminisrator in the session.
if($logged_info->is_admin != 'Y') $obj->content = removeHackTag($obj->content);
if($logged_info->is_admin != 'Y')
{
$obj->content = removeHackTag($obj->content);
}
// An error appears if both log-in info and user name don't exist.
if(!$logged_info->member_srl && !$obj->nick_name) return new BaseObject(-1, 'msg_invalid_request');
@ -692,7 +695,7 @@ class documentController extends document
if($obj->allow_trackback!='Y') $obj->allow_trackback = 'N';
if($obj->homepage)
{
$obj->homepage = removeHackTag($obj->homepage);
$obj->homepage = escape($obj->homepage);
if(!preg_match('/^[a-z]+:\/\//i',$obj->homepage))
{
$obj->homepage = 'http://'.$obj->homepage;