This vulnerability allows someone to create a source link that appears
to lead to Pixiv like normal, but that actually executes Javascript code
when clicked.
1) Set the source of a post to javascript:"http://img1.pixiv.net/img/xss/";alert("xss");
2) Wait for someone to click the source link in the Information sidebar.
3) Profit.
The cause is that the regexes for detecting Pixiv URLs aren't anchored
to the front of the string using \A. This allows non-http:// links to be
created.
Use the "\A" metacharacter for the beginning of a string, instead of "^"
for the beginning of any line within that string, and check for "://" as
well. Fixes#1947.
Additionally:
* Rename methods and variables related to the parent/child previews for
consistency.
* Split off siblings into a separate post set.
* Increase limit of children/siblings displayed to max of 200.
