Restrict external sources by host only

diff --git a/wcfsetup/install/files/lib/system/html/output/node/HtmlOutputNodeImg.class.php b/wcfsetup/install/files/lib/system/html/output/node/HtmlOutputNodeImg.class.php
index 10d47a60030bbddd87855bf628d912dff0eaca69..ab53c708960b493ea969c94c1f370b17eb88f82f 100644 (file)
--- a/wcfsetup/install/files/lib/system/html/output/node/HtmlOutputNodeImg.class.php
+++ b/wcfsetup/install/files/lib/system/html/output/node/HtmlOutputNodeImg.class.php
@@ -106,7 +106,7 @@ class HtmlOutputNodeImg extends AbstractHtmlOutputNode {
                                                $element->setAttribute('srcset', $srcset);
                                        }
                                }
-                               else if (!IMAGE_ALLOW_EXTERNAL_SOURCE && !ApplicationHandler::getInstance()->isInternalURL($src)) {
+                               else if (!IMAGE_ALLOW_EXTERNAL_SOURCE && !$this->isAllowedOrigin($src)) {
                                        $element->parentNode->insertBefore($element->ownerDocument->createTextNode('[IMG:'), $element);
                                        
                                        $link = $element->ownerDocument->createElement('a');
@@ -141,4 +141,19 @@ class HtmlOutputNodeImg extends AbstractHtmlOutputNode {
                        return $link;
                }
        }
+       
+       protected function isAllowedOrigin($src) {
+               static $ownDomains;
+               if ($ownDomains === null) {
+                       $ownDomains = array();
+                       foreach (ApplicationHandler::getInstance()->getApplications() as $application) {
+                               if (!in_array($application->domainName, $ownDomains)) {
+                                       $ownDomains[] = $application->domainName;
+                               }
+                       }
+               }
+               
+               $host = @parse_url($src, PHP_URL_HOST);
+               return $host !== false && in_array($host, $ownDomains);
+       }
 }