diff --git a/app/assets/javascripts/discourse/lib/url.js.es6 b/app/assets/javascripts/discourse/lib/url.js.es6 index 0f3364ab32..94ffa45229 100644 --- a/app/assets/javascripts/discourse/lib/url.js.es6 +++ b/app/assets/javascripts/discourse/lib/url.js.es6 @@ -173,8 +173,9 @@ const DiscourseURL = Ember.Object.createWithMixins({ * @method isInternal * @param {String} url **/ - isInternal: function(url) { + isInternal(url) { if (url && url.length) { + if (url.indexOf('//') === 0) { url = "http:" + url; } if (url.indexOf('#') === 0) { return true; } if (url.indexOf('/') === 0) { return true; } if (url.indexOf(this.origin()) === 0) { return true; } diff --git a/test/javascripts/lib/url-test.js.es6 b/test/javascripts/lib/url-test.js.es6 index 39941fd00e..7c420b58cc 100644 --- a/test/javascripts/lib/url-test.js.es6 +++ b/test/javascripts/lib/url-test.js.es6 @@ -7,8 +7,10 @@ test("isInternal with a HTTP url", function() { not(DiscourseURL.isInternal(null), "a blank URL is not internal"); ok(DiscourseURL.isInternal("/test"), "relative URLs are internal"); + ok(DiscourseURL.isInternal("//eviltrout.com"), "a url on the same host is internal (protocol-less)"); ok(DiscourseURL.isInternal("http://eviltrout.com/tophat"), "a url on the same host is internal"); ok(DiscourseURL.isInternal("https://eviltrout.com/moustache"), "a url on a HTTPS of the same host is internal"); + not(DiscourseURL.isInternal("//twitter.com.com"), "a different host is not internal (protocol-less)"); not(DiscourseURL.isInternal("http://twitter.com"), "a different host is not internal"); });