Added an option to enforce secure sources for images

Closes #2448

diff --git a/com.woltlab.wcf/option.xml b/com.woltlab.wcf/option.xml
index 44cafb75bb5d4f9b49762e8358060a97c905c0c4..535a300d9d305f75c146e2eaf0cf3c73cc7245d1 100644 (file)
--- a/com.woltlab.wcf/option.xml
+++ b/com.woltlab.wcf/option.xml
@@ -1064,6 +1064,11 @@ Pinterest</defaultvalue>
                        <!-- /message.general.share -->
                        
                        <!-- message.general.image -->
+                       <option name="message_force_secure_images">
+                               <categoryname>message.general.image</categoryname>
+                               <optiontype>boolean</optiontype>
+                               <defaultvalue>0</defaultvalue>
+                       </option>
                        <option name="module_image_proxy">
                                <categoryname>message.general.image</categoryname>
                                <optiontype>boolean</optiontype>

diff --git a/com.woltlab.wcf/templates/wysiwyg.tpl b/com.woltlab.wcf/templates/wysiwyg.tpl
index 4db7a0e6a56199607a3d9d4c57162a9b558a24fc..955057c4b9202ec9007d5a0833163af969a382ad 100644 (file)
--- a/com.woltlab.wcf/templates/wysiwyg.tpl
+++ b/com.woltlab.wcf/templates/wysiwyg.tpl
@@ -84,6 +84,7 @@
                                'wcf.editor.image.float.left': '{lang}wcf.editor.image.float.left{/lang}',
                                'wcf.editor.image.float.right': '{lang}wcf.editor.image.float.right{/lang}',
                                'wcf.editor.image.source': '{lang}wcf.editor.image.source{/lang}',
+                               'wcf.editor.image.source.error.insecure': '{lang}wcf.editor.image.source.error.insecure{/lang}',
                                'wcf.editor.image.source.error.invalid': '{lang}wcf.editor.image.source.error.invalid{/lang}',
                                
                                'wcf.editor.link.add': '{lang}wcf.editor.link.add{/lang}',
@@ -235,6 +236,7 @@
                                        buttons: buttonOptions,
                                        buttonMobile: buttonMobile,
                                        customButtons: customButtons,
+                                       forceSecureImages: {if MESSAGE_FORCE_SECURE_IMAGES}true{else}false{/if},
                                        highlighters: highlighters,
                                        media: {if $__wcf->session->getPermission('admin.content.cms.canUseMedia')}true{else}false{/if},
                                        mediaUrl: '{link controller='Media' id=-123456789 thumbnail='void' forceFrontend=true}{/link}'

diff --git a/constants.php b/constants.php
index a617e027bb38ab601df23f3b7529b09289a28177..ed9c59ba379afeca862046e326a0e9e938957710 100644 (file)
--- a/constants.php
+++ b/constants.php
@@ -131,6 +131,7 @@ define('MODULE_EDIT_HISTORY', 1);
 define('EDIT_HISTORY_EXPIRATION', 90);
 define('ENABLE_SHARE_BUTTONS', 1);
 define('SHARE_BUTTONS_PROVIDERS', '');
+define('MESSAGE_FORCE_SECURE_IMAGES', 0);
 define('MODULE_IMAGE_PROXY', 0);
 define('IMAGE_PROXY_INSECURE_ONLY', 0);
 define('IMAGE_PROXY_EXPIRATION', 14);

diff --git a/wcfsetup/install/files/acp/templates/wysiwyg.tpl b/wcfsetup/install/files/acp/templates/wysiwyg.tpl
index 4db7a0e6a56199607a3d9d4c57162a9b558a24fc..955057c4b9202ec9007d5a0833163af969a382ad 100644 (file)
--- a/wcfsetup/install/files/acp/templates/wysiwyg.tpl
+++ b/wcfsetup/install/files/acp/templates/wysiwyg.tpl
@@ -84,6 +84,7 @@
                                'wcf.editor.image.float.left': '{lang}wcf.editor.image.float.left{/lang}',
                                'wcf.editor.image.float.right': '{lang}wcf.editor.image.float.right{/lang}',
                                'wcf.editor.image.source': '{lang}wcf.editor.image.source{/lang}',
+                               'wcf.editor.image.source.error.insecure': '{lang}wcf.editor.image.source.error.insecure{/lang}',
                                'wcf.editor.image.source.error.invalid': '{lang}wcf.editor.image.source.error.invalid{/lang}',
                                
                                'wcf.editor.link.add': '{lang}wcf.editor.link.add{/lang}',
@@ -235,6 +236,7 @@
                                        buttons: buttonOptions,
                                        buttonMobile: buttonMobile,
                                        customButtons: customButtons,
+                                       forceSecureImages: {if MESSAGE_FORCE_SECURE_IMAGES}true{else}false{/if},
                                        highlighters: highlighters,
                                        media: {if $__wcf->session->getPermission('admin.content.cms.canUseMedia')}true{else}false{/if},
                                        mediaUrl: '{link controller='Media' id=-123456789 thumbnail='void' forceFrontend=true}{/link}'

diff --git a/wcfsetup/install/files/js/3rdParty/redactor2/plugins/WoltLabImage.js b/wcfsetup/install/files/js/3rdParty/redactor2/plugins/WoltLabImage.js
index 483d3fb53b523ea636302e3688a49c86ca5c91e5..1c21365ea94cd706b9d97188848da43649619906 100644 (file)
--- a/wcfsetup/install/files/js/3rdParty/redactor2/plugins/WoltLabImage.js
+++ b/wcfsetup/install/files/js/3rdParty/redactor2/plugins/WoltLabImage.js
@@ -54,6 +54,9 @@ $.Redactor.prototype.WoltLabImage = function() {
                                        else if (!source.match(this.opts.regexps.url)) {
                                                return showError(sourceInput, WCF.Language.get('wcf.editor.image.source.error.invalid'));
                                        }
+                                       else if (this.opts.woltlab.forceSecureImages && source.indexOf('http://') === 0) {
+                                               return showError(sourceInput, WCF.Language.get('wcf.editor.image.source.error.insecure'));
+                                       }
                                        
                                        // update image source
                                        image.src = source;

diff --git a/wcfsetup/install/files/lib/system/html/output/node/HtmlOutputNodeImg.class.php b/wcfsetup/install/files/lib/system/html/output/node/HtmlOutputNodeImg.class.php
index 5e2eeb0d978c4cb01259b0310f92d5047dd49feb..fcbed30d0133c5b3c3c3c53c1b3a9dba5bb12aa8 100644 (file)
--- a/wcfsetup/install/files/lib/system/html/output/node/HtmlOutputNodeImg.class.php
+++ b/wcfsetup/install/files/lib/system/html/output/node/HtmlOutputNodeImg.class.php
@@ -91,7 +91,7 @@ class HtmlOutputNodeImg extends AbstractHtmlOutputNode {
                                        if ($this->bypassProxy($urlComponents['host'])) {
                                                // check if page was requested over a secure connection
                                                // but the link is insecure
-                                               if (RouteHandler::secureConnection() && $urlComponents['scheme'] === 'http') {
+                                               if ((MESSAGE_FORCE_SECURE_IMAGES || RouteHandler::secureConnection()) && $urlComponents['scheme'] === 'http') {
                                                        // rewrite protocol to `https`
                                                        $element->setAttribute('src', preg_replace('~^http~', 'https', $src));
                                                }
@@ -127,6 +127,10 @@ class HtmlOutputNodeImg extends AbstractHtmlOutputNode {
                                                $element->setAttribute('srcset', $srcset);
                                        }
                                }
+                               else if (MESSAGE_FORCE_SECURE_IMAGES && Url::parse($src)['scheme'] === 'http') {
+                                       // rewrite protocol to `https`
+                                       $element->setAttribute('src', preg_replace('~^http~', 'https', $src));
+                               }
                        }
                }
        }

diff --git a/wcfsetup/install/lang/de.xml b/wcfsetup/install/lang/de.xml
index c53b1db33e8b7b10845df21276f30e5221fb319c..299c0ff8f2a2a2cf000557b99a7acc8ed680b56c 100644 (file)
--- a/wcfsetup/install/lang/de.xml
+++ b/wcfsetup/install/lang/de.xml
@@ -1373,6 +1373,8 @@ Als Benachrichtigungs-URL in der Konfiguration der sofortigen Zahlungsbestätigu
                <item name="wcf.acp.option.article_show_about_author"><![CDATA[„Über den Autor“ anzeigen]]></item>
                <item name="wcf.acp.option.category.message.general.image"><![CDATA[Bilder]]></item>
                <item name="wcf.acp.option.module_article"><![CDATA[Artikel]]></item>
+               <item name="wcf.acp.option.message_force_secure_images"><![CDATA[Nur sichere Bilder in Nachrichten erlauben]]></item>
+               <item name="wcf.acp.option.message_force_secure_images.description"><![CDATA[Bilder dürfen nur über das verschlüsselte „https“-Protokoll eingebunden werden. Bereits in bestehenden Nachrichten hinterlegte Bilder werden zwangsweise auf dieses Protokoll umgeschrieben.]]></item>
                <item name="wcf.acp.option.module_image_proxy"><![CDATA[Zwischenspeicherung von externen Bilder aktivieren]]></item>
                <item name="wcf.acp.option.image_proxy_expiration"><![CDATA[Speicherzeit]]></item>
                <item name="wcf.acp.option.image_proxy_insecure_only"><![CDATA[Nur Bilder aus unverschlüsselten Quellen zwischenspeichern]]></item>
@@ -2804,6 +2806,7 @@ Fehler sind beispielsweise:
                <item name="wcf.editor.image.float.left"><![CDATA[Links]]></item>
                <item name="wcf.editor.image.float.right"><![CDATA[Rechts]]></item>
                <item name="wcf.editor.image.source"><![CDATA[Quelle]]></item>
+               <item name="wcf.editor.image.source.error.insecure"><![CDATA[Unsichere Adressen („http://“) wurden für Bilder deaktiviert, bitte verwenden Sie nur sichere Adressen („https://“).]]></item>
                <item name="wcf.editor.image.source.error.invalid"><![CDATA[Der eingegebene Link ist ungültig.]]></item>
                
                <item name="wcf.editor.link.add"><![CDATA[Link einfügen]]></item>

diff --git a/wcfsetup/install/lang/en.xml b/wcfsetup/install/lang/en.xml
index ae7331a51d00831b9761fd19fd774e0fe1ac3a44..1c29d38acce9820a8750c06bf9611b543504a7cb 100644 (file)
--- a/wcfsetup/install/lang/en.xml
+++ b/wcfsetup/install/lang/en.xml
@@ -1366,6 +1366,8 @@ When prompted for the notification URL for the instant payment notifications, pl
                <item name="wcf.acp.option.article_show_about_author"><![CDATA[Display “about the author” box]]></item>
                <item name="wcf.acp.option.category.message.general.image"><![CDATA[Images]]></item>
                <item name="wcf.acp.option.module_article"><![CDATA[Articles]]></item>
+               <item name="wcf.acp.option.message_force_secure_images"><![CDATA[Allow secure images only]]></item>
+               <item name="wcf.acp.option.message_force_secure_images.description"><![CDATA[Images may only be embedded using the encrypted “https”-protocol. Images in already existing messages will be force-rewritten to use the secure protocol.]]></item>
                <item name="wcf.acp.option.module_image_proxy"><![CDATA[Enable image proxy]]></item>
                <item name="wcf.acp.option.image_proxy_expiration"><![CDATA[Storage Time Period]]></item>
                <item name="wcf.acp.option.image_proxy_insecure_only"><![CDATA[Store images from insecure sources only]]></item>
@@ -2752,6 +2754,7 @@ Errors are:
                <item name="wcf.editor.image.float.left"><![CDATA[Left]]></item>
                <item name="wcf.editor.image.float.right"><![CDATA[Right]]></item>
                <item name="wcf.editor.image.source"><![CDATA[Source]]></item>
+               <item name="wcf.editor.image.source.error.insecure"><![CDATA[Insecure sources (“http://”) for images have been disabled, please use secure sources only (“https://”).]]></item>
                <item name="wcf.editor.image.source.error.invalid"><![CDATA[You have entered an invalid link.]]></item>
                
                <item name="wcf.editor.link.add"><![CDATA[Insert Link]]></item>