You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When a link is created in a Redactor field, a "reference tag" containing a fallback URL is saved in the database. For example: {entry:12@1:url||http://localhost:5000/test}
The problem arises when the referenced entry is subsequently deleted. In such cases, the URL stored within the reference tag can be incorrect or potentially dangerous. This poses a security risk, especially when content is encoded in a staging environment and then transferred to production, as the staging URL may be exposed.
Steps to reproduce
In a staging environnement, create a link in a Redactor field, referencing a valid entry.
Deploy this database in production.
Delete the referenced entry.
The link output the fallback url with staging url instead of production url.
Proposed Solution
Consider using relative URLs instead of absolute URLs for fallback when linking to Entries or Assets.
Or add a config to disable fallbacks
The text was updated successfully, but these errors were encountered:
Description
When a link is created in a Redactor field, a "reference tag" containing a fallback URL is saved in the database. For example:
{entry:12@1:url||http://localhost:5000/test}
The problem arises when the referenced entry is subsequently deleted. In such cases, the URL stored within the reference tag can be incorrect or potentially dangerous. This poses a security risk, especially when content is encoded in a staging environment and then transferred to production, as the staging URL may be exposed.
Steps to reproduce
Proposed Solution
Consider using relative URLs instead of absolute URLs for fallback when linking to Entries or Assets.
Or add a config to disable fallbacks
The text was updated successfully, but these errors were encountered: