14 lines
300 B
JavaScript
14 lines
300 B
JavaScript
// prevent XSS
|
|
Discourse.Dialect.on('parseNode', function (event) {
|
|
var node = event.node;
|
|
|
|
if (node[0] === 'a') {
|
|
var attributes = node[1];
|
|
if (attributes["href"]) {
|
|
if (!Discourse.Markdown.urlAllowed(attributes["href"])) {
|
|
delete attributes["href"];
|
|
}
|
|
}
|
|
}
|
|
});
|