X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/4bfdbd4858bc7842df97902e0bc9bd5d2bef861e..4c6d359b5fbe8f746965a2646a7bea03284b23cc:/IkiWiki/Plugin/htmlscrubber.pm?ds=sidebyside

diff --git a/IkiWiki/Plugin/htmlscrubber.pm b/IkiWiki/Plugin/htmlscrubber.pm
index 8c37f1be6..923907b04 100644
--- a/IkiWiki/Plugin/htmlscrubber.pm
+++ b/IkiWiki/Plugin/htmlscrubber.pm
@@ -10,12 +10,13 @@ use IkiWiki 2.00;
 our $safe_url_regexp;
 
 sub import { #{{{
+	hook(type => "getsetup", id => "htmlscrubber", call => \&getsetup);
 	hook(type => "sanitize", id => "htmlscrubber", call => \&sanitize);
 
 	# Only known uri schemes are allowed to avoid all the ways of
 	# embedding javascrpt.
 	# List at http://en.wikipedia.org/wiki/URI_scheme
-	my $uri_schemes=join("|",
+	my $uri_schemes=join("|", map quotemeta,
 		# IANA registered schemes
 		"http", "https", "ftp", "mailto", "file", "telnet", "gopher",
 		"aaa", "aaas", "acap", 	"cap", "cid", "crid", 
@@ -27,13 +28,21 @@ sub import { #{{{
 		"aim", "callto", "cvs", "ed2k", "feed", "fish", "gg",
 		"irc", "ircs", "lastfm", "ldaps", "magnet", "mms",
 		"msnim", "notes", "rsync", "secondlife", "skype", "ssh",
-		"sftp", "sms", "steam", "webcal", "ymsgr",
+		"sftp", "smb", "sms", "snews", "webcal", "ymsgr",
 	);
 	# data is a special case. Allow data:image/*, but
 	# disallow data:text/javascript and everything else.
-	$safe_url_regexp=qr/^(?:(?:$uri_schemes):|data:image\/|[^:]+$)/i;
+	$safe_url_regexp=qr/^(?:(?:$uri_schemes):|data:image\/|[^:]+(?:$|\/))/i;
 } # }}}
 
+sub getsetup () { #{{{
+	return
+		plugin => {
+			safe => 1,
+			rebuild => undef,
+		},
+} #}}}
+
 sub sanitize (@) { #{{{
 	my %params=@_;
 	return scrubber()->scrub($params{content});