processwire-issues icon indicating copy to clipboard operation
processwire-issues copied to clipboard

Relative links passing through Sanitizer::httpUrl() default to http in all cases

Open romaincazier opened this issue 3 months ago • 0 comments

Hi,

While updating my PageMjmlToHtml module, I’ve been wondering if Sanitizer::httpUrl() shouldn’t default to https in respect to $config->https?

Otherwise it could be an added option to Sanitizer::url(), something like forceHttps.

You would need to edit these lines and here is a suggestion:

if(!$scheme) {
	$https = $this->wire()->config->https ? "https" : "http";

	/* ... */

	if($options['allowRelative']) {
		/* ... */
		if($dotPos && $slashPos > $dotPos && preg_match($regex, $value, $matches)) {
			/* ... */
			$value = $this->filterValidateURL("$https://$value", $options); // add scheme for validation

		} else if($options['allowQuerystring']) {
			/* ... */
			$fake = "$https://processwire.com/";
			/* ... */
		}
	} else {
		/* ... */
		$value = $this->filterValidateURL("$https://$value", $options);
	}

	if(!$options['requireScheme']) {
		/* ... */
		$value = str_replace("$https://", '', $value);
	}
} else if($scheme !== 'tel') { /* ... */

Thanks for considering.

romaincazier avatar Sep 08 '25 12:09 romaincazier