Merge pull request #6691 from pixelfed/shleeable-patch-26

Improve validation

app/Http/Controllers/Admin/AdminUserController.php

@@ -92,6 +92,10 @@ trait AdminUserController
 
     public function userEditSubmit(Request $request, $id)
     {
+        $this->validate($request, [
+            'website' => 'nullable|url|max:120',
+        ]);
+
         $user = User::findOrFail($id);
         $profile = $user->profile;
         $changed = false;

app/Http/Controllers/Api/ApiV1Controller.php

@@ -346,22 +346,23 @@ class ApiV1Controller extends Controller
             $website = $request->input('website');
             if ($website != $profile->website) {
                 if ($website) {
-                    if (! strpos($website, '.')) {
+                    // Validate URL scheme FIRST
+                    if (!Str::startsWith($website, ['http://', 'https://'])) {
                         $website = null;
-                    }
-
-                    if ($website && ! strpos($website, '://')) {
-                        $website = 'https://'.$website;
-                    }
+                    } else {
+                        if (!strpos($website, '.')) {
+                            $website = null;
+                        }
 
-                    $host = parse_url($website, PHP_URL_HOST);
+                        $host = parse_url($website, PHP_URL_HOST);
 
-                    $bannedInstances = InstanceService::getBannedDomains();
-                    if (in_array($host, $bannedInstances)) {
-                        $website = null;
+                        $bannedInstances = InstanceService::getBannedDomains();
+                        if (in_array($host, $bannedInstances)) {
+                            $website = null;
+                        }
                     }
                 }
-                $profile->website = $website ? $website : null;
+                $profile->website = $website;
                 $changes = true;
             }
         }