Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-11-03 20:45:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

using url module to normalise passed-in url prior to saving in db, closes #3043

Browse Source
This commit is contained in:
Julian Lam
2015-04-17 15:15:43 -04:00
parent 23c4ecfe60
commit 5d495483ad
2 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/controllers/accounts.js
View File

@@ -96,7 +96,6 @@ function getUserDataByUserSlug(userslug, callerUID, callback) {
userData.username = validator.escape(userData.username); userData.username = validator.escape(userData.username);
userData.email = validator.escape(userData.email); userData.email = validator.escape(userData.email);
userData.fullname = validator.escape(userData.fullname); userData.fullname = validator.escape(userData.fullname);
userData.websiteName = validator.escape(userData.websiteName);
userData.location = validator.escape(userData.location); userData.location = validator.escape(userData.location);
userData.signature = validator.escape(userData.signature); userData.signature = validator.escape(userData.signature);

15
src/user/profile.js
View File

@@ -3,6 +3,7 @@
var async = require('async'), var async = require('async'),
validator = require('validator'), validator = require('validator'),
url = require('url'),
S = require('string'), S = require('string'),
utils = require('../../public/src/utils'), utils = require('../../public/src/utils'),
@@ -121,9 +122,19 @@ module.exports = function(User) {
} else if (field === 'signature') { } else if (field === 'signature') {
data[field] = S(data[field]).stripTags().s; data[field] = S(data[field]).stripTags().s;
} else if (field === 'website') { } else if (field === 'website') {
if (data[field] && !data[field].startsWith('http://') && !data[field].startsWith('https://')) { var urlObj = url.parse(data[field], false, true);
data[field] = 'http://' + data[field]; if (!urlObj.protocol) {
urlObj.protocol = 'http';
urlObj.slashes = true;
} }
if (!urlObj.hostname && urlObj.pathname) {
urlObj.hostname = urlObj.pathname;
urlObj.pathname = null;
}
if (urlObj.pathname === '/') {
urlObj.pathname = null;
}
data[field] = url.format(urlObj);
} }
User.setUserField(uid, field, data[field], next); User.setUserField(uid, field, data[field], next);