Discourse/discourse
Discourse/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-09-11 21:04:42 +08:00
Code Packages Activity Actions 10

FIX: Respect blocked domains list when redirecting (#15656)

Browse source 
Our previous implementation used a simple `blocked_domain_array.include?(hostname)`
so some values were not matching. Additionally, in some configurations like ours, we'd used
"cat.*.dog.com" with the assumption we'd support globbing.

This change implicitly allows globbing by blocking "http://a.b.com" if "b.com" is a blocked 
domain but does not actively do anything for "*".

An upcoming change might include frontend validation for values that can be inserted.
This commit is contained in:
Natalie Tay 2022-01-20 14:12:34 +08:00 • committed by GitHub
parent 191bdac4f0
commit f5ea00c73f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 73 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

9
lib/inline_oneboxer.rb
View file

@ -51,7 +51,6 @@ class InlineOneboxer

always_allow = SiteSetting.enable_inline_onebox_on_all_domains
allowed_domains = SiteSetting.allowed_inline_onebox_domains&.split('|') unless always_allow
blocked_domains = SiteSetting.blocked_onebox_domains&.split('|')

if always_allow || allowed_domains
uri = begin
@ -62,7 +61,7 @@ class InlineOneboxer
if uri.present? &&
uri.hostname.present? &&
(always_allow || allowed_domains.include?(uri.hostname)) &&
!blocked_domains.include?(uri.hostname)
!domain_is_blocked?(uri.hostname)
title = RetrieveTitle.crawl(url)
title = nil if title && title.length < MIN_TITLE_LENGTH
return onebox_for(url, title, opts)
@ -74,6 +73,12 @@ class InlineOneboxer

private

def self.domain_is_blocked?(hostname)
SiteSetting.blocked_onebox_domains&.split('|').any? do |blocked|
hostname == blocked || hostname.end_with?(".#{blocked}")
end
end

def self.onebox_for(url, title, opts)
title = title && Emoji.gsub_emoji_to_unicode(title)
if title && opts[:post_number]