Restrict external sources by host only

diff --git a/wcfsetup/install/files/lib/system/bbcode/ImageBBCode.class.php b/wcfsetup/install/files/lib/system/bbcode/ImageBBCode.class.php
index 3465f32c5cf4efc4091ae29743c68e78edead97b..05f8dfd6dda90fd6741beef35c123ac25f42eba2 100644 (file)
--- a/wcfsetup/install/files/lib/system/bbcode/ImageBBCode.class.php
+++ b/wcfsetup/install/files/lib/system/bbcode/ImageBBCode.class.php
@@ -24,7 +24,7 @@ class ImageBBCode extends AbstractBBCode {
                }
                
                if ($parser->getOutputType() == 'text/html') {
-                       if (!IMAGE_ALLOW_EXTERNAL_SOURCE && !ApplicationHandler::getInstance()->isInternalURL($src)) {
+                       if (!IMAGE_ALLOW_EXTERNAL_SOURCE && !$this->isAllowedOrigin($src)) {
                                return '[IMG:<a href="'.$src.'">'.$src.'</a>]';
                        }
                        
@@ -57,4 +57,19 @@ class ImageBBCode extends AbstractBBCode {
                        return '';
                }
        }
+       
+       protected function isAllowedOrigin($src) {
+               static $ownDomains;
+               if ($ownDomains === null) {
+                       $ownDomains = array();
+                       foreach (ApplicationHandler::getInstance()->getApplications() as $application) {
+                               if (!in_array($application->domainName, $ownDomains)) {
+                                       $ownDomains[] = $application->domainName;
+                               }
+                       }
+               }
+               
+               $host = @parse_url($src, PHP_URL_HOST);
+               return $host !== false && in_array($host, $ownDomains);
+       }
 }