Allow external web links in market rich text

modules/market_management/service.php

@@ -26,15 +26,21 @@ const MARKET_MANAGEMENT_MULTILINE_FIELDS = [
     'description',
 ];
 
-function market_management_is_allowed_document_url(string $url): bool
+function market_management_is_allowed_link_url(string $url): bool
 {
     $parts = parse_url($url);
     if (!is_array($parts)
-        || ($parts['scheme'] ?? '') !== 'https'
-        || ($parts['host'] ?? '') !== 'erpnaurua.imhochrain.ch'
-        || ($parts['path'] ?? '') !== '/files.php'
-        || isset($parts['port'], $parts['user'], $parts['pass'], $parts['fragment'])
-        || !preg_match('/^path=([^&]+)$/', (string) ($parts['query'] ?? ''), $matches)) {
+        || !in_array(($parts['scheme'] ?? ''), ['http', 'https'], true)
+        || ($parts['host'] ?? '') === ''
+        || isset($parts['user'], $parts['pass'])) {
+        return false;
+    }
+
+    if (($parts['host'] ?? '') !== 'erpnaurua.imhochrain.ch' || ($parts['path'] ?? '') !== '/files.php') {
+        return true;
+    }
+
+    if (isset($parts['port'], $parts['fragment']) || !preg_match('/^path=([^&]+)$/', (string) ($parts['query'] ?? ''), $matches)) {
         return false;
     }
 
@@ -88,12 +94,12 @@ function market_management_sanitize_multiline_html(?string $value): ?string
             continue;
         }
         if (preg_match('/^<a\b[^>]*\bhref\s*=\s*(["\'])(.*?)\1[^>]*>$/isu', $token, $matches)
-            && market_management_is_allowed_document_url($matches[2])) {
+            && market_management_is_allowed_link_url($matches[2])) {
             if ($anchorOpen) {
                 $result .= '</a>';
             }
             $href = htmlspecialchars($matches[2], ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
-            $result .= '<a class="sg-hyperlink" href="' . $href . '" target="_blank" rel="noopener">';
+            $result .= '<a class="sg-hyperlink" href="' . $href . '" target="_blank" rel="noopener noreferrer">';
             $anchorOpen = true;
             continue;
         }