Remove href attribute if it executes JavaScript.

[tt-rss.git] / include / functions2.php

diff --git a/include/functions2.php b/include/functions2.php
index 0a4f4309ee2dacb8df786ebe6dfa6a21eb095cde..dceea507ee882ccbc6f15935c1a959ad7795ad26 100644 (file)
--- a/include/functions2.php
+++ b/include/functions2.php
@@ -89,6 +89,7 @@
                                "feed_edit" => __("Edit feed"),
                                "feed_catchup" => __("Mark as read"),
                                "feed_reverse" => __("Reverse headlines"),
+                               "feed_toggle_vgroup" => __("Toggle headline grouping"),
                                "feed_debug_update" => __("Debug feed update"),
                                "feed_debug_viewfeed" => __("Debug viewfeed()"),
                                "catchup_all" => __("Mark all feeds as read"),
@@ -158,6 +159,7 @@
                                "f e" => "feed_edit",
                                "f q" => "feed_catchup",
                                "f x" => "feed_reverse",
+                               "f g" => "feed_toggle_vgroup",
                                "f *d" => "feed_debug_update",
                                "f *g" => "feed_debug_viewfeed",
                                "f *c" => "toggle_combined_mode",
@@ -1062,6 +1064,10 @@
                                                array_push($attrs_to_remove, $attr);
                                        }
 
+                                       if ($attr->nodeName == 'href' && stripos($attr->value, 'javascript:') === 0) {
+                                               array_push($attrs_to_remove, $attr);
+                                       }
+
                                        if (in_array($attr->nodeName, $disallowed_attributes)) {
                                                array_push($attrs_to_remove, $attr);
                                        }