#1932 disallow css urls

2015-04-21 15:10:14 -04:00
parent e9af343161
commit 3a66e521fc
1 changed files with 3 additions and 1 deletions
--- a/app/logical/d_text.rb
+++ b/app/logical/d_text.rb
@@ -322,7 +322,9 @@ class DText
          "href" => ["http", "https", :relative]
        }
      },
-      :css => Sanitize::Config::RELAXED[:css]
+      :css => Sanitize::Config::RELAXED[:css].merge({
+        :protocols => []
+      })
    )
  end
 end