Skip to content

Commit

Permalink
Build page checks https
Browse files Browse the repository at this point in the history
Thanks to @tpeland #18
  • Loading branch information
cogdog committed Jan 5, 2017
1 parent b71c8f3 commit 8043f19
Show file tree
Hide file tree
Showing 3 changed files with 13 additions and 6 deletions.
4 changes: 3 additions & 1 deletion build.php
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,9 @@
// URLs for a preview or a generated feed link

// trap for missing src param for the feed, use a dummy one so it gets displayed.
if (!$src or strpos($src, 'http://') !==0) die('Feed URL missing, incomplete, or not valid. Must start with http:// and be a valid URL');
if (!$src or
(strpos($src, 'http://') !==0 and strpos($src, 'https://') !==0))
die('Feed URL missing, incomplete, or not valid. Must start with http:// or https:// and be a valid URL');


// test for malicious use of script tages
Expand Down
11 changes: 8 additions & 3 deletions feed2js.php
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,11 @@

// check if site has a setting to restrict to a url
if (isset($restrict_url)) {
$src_host = substr($src, 7);
if (strpos($src, 'https://') == 0) {
$src_host = substr($src, 8);
} else {
$src_host = substr($src, 7);
}
$src_pos = strpos($src_host,"/");
if ($src_pos) {
$src_host = substr($src_host,0, $src_pos);
Expand All @@ -153,8 +157,9 @@
$str.= "document.write('<div class=\"rss-box" . $rss_box_id .
"\"><p class=\"rss-item\"><em>Error:</em> on feed <strong>" .
$src . "</strong>. " .
"Feeds are allowed only from URLs from the site http://*" .
$restrict_url . "</p></div>');\n";
"Feeds are allowed only from URLs from the sites http://*" .
$restrict_url . " and https://*" . $restrict_url .
"</p></div>');\n";

} else {

Expand Down
4 changes: 2 additions & 2 deletions preview.php
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -27,8 +27,8 @@
}

// trap for missing src param for the feed, use a dummy one so it gets displayed.
if (!$src or strpos($src, 'http://') !==0) die('Feed URL missing, incomplete, or not valid. Must start with http:// and be a valid URL');

if (!$src or (strpos($src, 'http://') !==0 and strpos($src, 'https://') !==0))
die('Feed URL missing, incomplete, or not valid. Must start with http:// or https:// and be a valid URL');

// update to full descriptions for html turned on
if ($html=='a') $desc = 0;
Expand Down

0 comments on commit 8043f19

Please sign in to comment.