Allow external web links in market rich text

modules/market_management/service.php

@@ -26,15 +26,21 @@ const MARKET_MANAGEMENT_MULTILINE_FIELDS = [
     'description',
 ];
 
-function market_management_is_allowed_document_url(string $url): bool
+function market_management_is_allowed_link_url(string $url): bool
 {
     $parts = parse_url($url);
     if (!is_array($parts)
-        || ($parts['scheme'] ?? '') !== 'https'
-        || ($parts['host'] ?? '') !== 'erpnaurua.imhochrain.ch'
-        || ($parts['path'] ?? '') !== '/files.php'
-        || isset($parts['port'], $parts['user'], $parts['pass'], $parts['fragment'])
-        || !preg_match('/^path=([^&]+)$/', (string) ($parts['query'] ?? ''), $matches)) {
+        || !in_array(($parts['scheme'] ?? ''), ['http', 'https'], true)
+        || ($parts['host'] ?? '') === ''
+        || isset($parts['user'], $parts['pass'])) {
+        return false;
+    }
+
+    if (($parts['host'] ?? '') !== 'erpnaurua.imhochrain.ch' || ($parts['path'] ?? '') !== '/files.php') {
+        return true;
+    }
+
+    if (isset($parts['port'], $parts['fragment']) || !preg_match('/^path=([^&]+)$/', (string) ($parts['query'] ?? ''), $matches)) {
         return false;
     }
 
@@ -88,12 +94,12 @@ function market_management_sanitize_multiline_html(?string $value): ?string
             continue;
         }
         if (preg_match('/^<a\b[^>]*\bhref\s*=\s*(["\'])(.*?)\1[^>]*>$/isu', $token, $matches)
-            && market_management_is_allowed_document_url($matches[2])) {
+            && market_management_is_allowed_link_url($matches[2])) {
             if ($anchorOpen) {
                 $result .= '</a>';
             }
             $href = htmlspecialchars($matches[2], ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
-            $result .= '<a class="sg-hyperlink" href="' . $href . '" target="_blank" rel="noopener">';
+            $result .= '<a class="sg-hyperlink" href="' . $href . '" target="_blank" rel="noopener noreferrer">';
             $anchorOpen = true;
             continue;
         }

modules/shared/auth/ui/home.php

@@ -1152,7 +1152,7 @@ function render_auth_home_page(array $user, array $otcProducts = [], array $otcM
     echo "  const getCurrentLimit = () => parseInt(getTable()?.dataset.marketsLimit || '20', 10);";
     echo "  const getPageSize = () => parseInt(getTable()?.dataset.marketsPageSize || '20', 10);";
     echo "  const marketEscape = (value) => String(value ?? '').replace(/[&<>\"']/g, (character) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '\"': '&quot;', \"'\": '&#39;' }[character] || character));";
-    echo "  const marketDisplay = (value) => { if (value === null || value === undefined || value === '') { return 'Nicht hinterlegt'; } const escaped = marketEscape(value); const safeMarkup = escaped.replace(/&lt;br&gt;/g, '<br>').replace(/&lt;strong&gt;/g, '<strong>').replace(/&lt;\\/strong&gt;/g, '</strong>').replace(/&lt;a class=&quot;sg-hyperlink&quot; href=&quot;(https:\\/\\/erpnaurua\\.imhochrain\\.ch\\/files\\.php\\?path=[^&quot;]+)&quot; target=&quot;_blank&quot; rel=&quot;noopener&quot;&gt;/g, '<a class=\"sg-hyperlink\" href=\"$1\" target=\"_blank\" rel=\"noopener\">').replace(/&lt;\\/a&gt;/g, '</a>'); return safeMarkup.replace(/\\r?\\n/g, '<br>'); };";
+    echo "  const marketDisplay = (value) => { if (value === null || value === undefined || value === '') { return 'Nicht hinterlegt'; } const escaped = marketEscape(value); const safeMarkup = escaped.replace(/&lt;br&gt;/g, '<br>').replace(/&lt;strong&gt;/g, '<strong>').replace(/&lt;\\/strong&gt;/g, '</strong>').replace(/&lt;a class=&quot;sg-hyperlink&quot; href=&quot;(https?:\\/\\/.*?)&quot; target=&quot;_blank&quot; rel=&quot;noopener noreferrer&quot;&gt;/g, '<a class=\"sg-hyperlink\" href=\"$1\" target=\"_blank\" rel=\"noopener noreferrer\">').replace(/&lt;\\/a&gt;/g, '</a>'); return safeMarkup.replace(/\\r?\\n/g, '<br>'); };";
     echo "  const marketBoolean = (value) => value === true || value === 'true' || value === 1 || value === '1' ? 'Ja' : value === false || value === 'false' || value === 0 || value === '0' ? 'Nein' : 'Nicht hinterlegt';";
     echo "  const marketMoney = (value) => value === null || value === undefined || value === '' ? 'Nicht hinterlegt' : 'CHF ' + Number(value).toFixed(2);";
     echo "  const marketContactName = (contact) => { if (!contact) { return 'Nicht hinterlegt'; } return marketDisplay([contact.first_name, contact.last_name].filter(Boolean).join(' ')); };";