| @@ -486,13 +486,14 @@ | ||
| 486 | 486 | /** |
| 487 | 487 | * Make sure any src/href attribute does not contain relative URLs. |
| 488 | 488 | * |
| 489 | 489 | * @since 1.15 (J) - 1.5.0 (WP) |
| 490 | + * @since 1.18.8 (J) - 1.8.8 (WP) ignore attributes containing a special tag. | |
| 490 | 491 | */ |
| 491 | 492 | $cond_texts[$token]['msg'] = preg_replace_callback("/\s*(src|href)=([\"'])(.*?)[\"']/i", function($match) { |
| 492 | 493 | // check if the URL starts with the base domain |
| 493 | - if (stripos($match[3], JUri::root()) !== 0 && !preg_match("/^(https?:\/\/|www\.)/i", $match[3])) { | |
| 494 | - // prepend base domain to URL | |
| 494 | + if (stripos($match[3], JUri::root()) !== 0 && !preg_match("/^(https?:\/\/|www\.|{)/i", $match[3])) { | |
| 495 | + // safely prepend base domain to URL | |
| 495 | 496 | $match[0] = ' ' . $match[1] . '=' . $match[2] . JUri::root() . $match[3] . $match[2]; |
| 496 | 497 | } |
| 497 | 498 | return $match[0]; |
| 498 | 499 | }, $cond_texts[$token]['msg']); |
