| @@ -7,8 +7,22 @@ | ||
| 7 | 7 | function ($scope) { |
| 8 | 8 | elementorFrontend.elementsHandler.addHandler( |
| 9 | 9 | elementorModules.frontend.handlers.Base.extend({ |
| 10 | 10 | onInit() { |
| 11 | + const normalizeSafeUrl = (rawUrl) => { | |
| 12 | + if (!rawUrl || typeof rawUrl !== "string") return null; | |
| 13 | + try { | |
| 14 | + const url = new URL(rawUrl, window.location.href); | |
| 15 | + const allowedProtocols = ["http:", "https:", "mailto:", "tel:"]; | |
| 16 | + if (allowedProtocols.includes(url.protocol)) { | |
| 17 | + return url.href; | |
| 18 | + } | |
| 19 | + } catch (e) { | |
| 20 | + // ignore | |
| 21 | + } | |
| 22 | + return null; | |
| 23 | + }; | |
| 24 | + | |
| 11 | 25 | const $elem = this.$element, |
| 12 | 26 | $wrap = $elem.find(".king-addons-image-accordion"), |
| 13 | 27 | $wrapContainer = $elem.find(".king-addons-image-accordion-wrap"), |
| 14 | 28 | settings = JSON.parse( |
| @@ -132,16 +146,20 @@ | ||
| 132 | 146 | ".king-addons-img-accordion-item-lightbox" |
| 133 | 147 | ).length |
| 134 | 148 | ) { |
| 135 | 149 | const itemUrl = thisSettings.activeItem.overlayLink; |
| 136 | - if (itemUrl) { | |
| 150 | + const safeUrl = normalizeSafeUrl(itemUrl); | |
| 151 | + if (safeUrl) { | |
| 137 | 152 | if ( |
| 138 | 153 | thisSettings.activeItem.overlayLinkTarget === |
| 139 | 154 | "_blank" |
| 140 | 155 | ) { |
| 141 | - window.open(itemUrl, "_blank").focus(); | |
| 156 | + const w = window.open(safeUrl, "_blank"); | |
| 157 | + if (w && typeof w.focus === "function") { | |
| 158 | + w.focus(); | |
| 159 | + } | |
| 142 | 160 | } else { |
| 143 | - window.location.href = itemUrl; | |
| 161 | + window.location.href = safeUrl; | |
| 144 | 162 | } |
| 145 | 163 | } |
| 146 | 164 | } |
| 147 | 165 | }); |
| @@ -215,16 +233,20 @@ | ||
| 215 | 233 | ".king-addons-img-accordion-item-lightbox" |
| 216 | 234 | ).length |
| 217 | 235 | ) { |
| 218 | 236 | const itemUrl = thisSettings.activeItem.overlayLink; |
| 219 | - if (itemUrl) { | |
| 237 | + const safeUrl = normalizeSafeUrl(itemUrl); | |
| 238 | + if (safeUrl) { | |
| 220 | 239 | if ( |
| 221 | 240 | thisSettings.activeItem.overlayLinkTarget === |
| 222 | 241 | "_blank" |
| 223 | 242 | ) { |
| 224 | - window.open(itemUrl, "_blank").focus(); | |
| 243 | + const w = window.open(safeUrl, "_blank"); | |
| 244 | + if (w && typeof w.focus === "function") { | |
| 245 | + w.focus(); | |
| 246 | + } | |
| 225 | 247 | } else { |
| 226 | - window.location.href = itemUrl; | |
| 248 | + window.location.href = safeUrl; | |
| 227 | 249 | } |
| 228 | 250 | } |
| 229 | 251 | } |
| 230 | 252 | } else { |
