@recaptime-dev's working patches + fork for Phorge, a community fork of Phabricator. (Upstream dev and stable branches are at upstream/main and upstream/stable respectively.)
hq.recaptime.dev/wiki/Phorge
phorge
phabricator
Update documentation for "uri.allowed-protocols"
Summary: See <https://discourse.phabricator-community.org/t/download-tasks-and-others-as-excel-throw-exception/>.
Test Plan: Read config.
Reviewers: amckinley, avivey
Reviewed By: avivey
Subscribers: avivey
Differential Revision: https://secure.phabricator.com/D20430
+18
-6
+18
-6
src/applications/config/option/PhabricatorSecurityConfigOptions.php
+18
-6
src/applications/config/option/PhabricatorSecurityConfigOptions.php
···
163
163
'mailto' => true,
164
164
))
165
165
->setSummary(
166
-
pht('Determines which URI protocols are auto-linked.'))
166
+
pht(
167
+
'Determines which URI protocols are valid for links and '.
168
+
'redirects.'))
167
169
->setDescription(
168
170
pht(
169
-
"When users write comments which have URIs, they'll be ".
170
-
"automatically linked if the protocol appears in this set. This ".
171
-
"whitelist is primarily to prevent security issues like ".
172
-
"%s URIs.",
173
-
'javascript://'))
171
+
'When users write comments which have URIs, they will be '.
172
+
'automatically turned into clickable links if the URI protocol '.
173
+
'appears in this set.'.
174
+
"\n\n".
175
+
'This set of allowed protocols is primarily intended to prevent '.
176
+
'security issues with "javascript:" and other potentially '.
177
+
'dangerous URI handlers.'.
178
+
"\n\n".
179
+
'This set is also used to enforce valid redirect URIs. '.
180
+
'Phabricator will refuse to issue a HTTP "Location" redirect to a '.
181
+
'URI with a protocol not on this set.'.
182
+
"\n\n".
183
+
'Usually, "http" and "https" should be present in this set. If '.
184
+
'you remove one or both protocols, some Phabricator features '.
185
+
'which rely on links or redirects may not work.'))
174
186
->addExample("http\nhttps", pht('Valid Setting'))
175
187
->setLocked(true),
176
188
$this->newOption(