Version 4.3.6

system/Helpers/Form/Editor.php

@@ -45,6 +45,7 @@ class _Editor extends FormAbstract
 	 		'maxLength'		=> FALSE,	// The maximum length. Note that the content is HTML, so this isn't the maximum number of visible characters, so should only be used for database limits. The database's max allowed packet will override if smaller
 	 		'editorId'		=> NULL,	// Passed to editorAttachments. Only necessary if the name may be changed
 	 		'allowAttachments => TRUE,	// Should the editor show upload options?
+	 		'embedLocalOnly'  => FALSE, // Allow local embeds only
 	 	);
 	 * @endcode
 	 */
@@ -64,6 +65,7 @@ class _Editor extends FormAbstract
 		'maxLength'				=> 16777215, // The default for MEDIUMTEXT */
 		'editorId'				=> NULL,
 		'allowAttachments'		=> TRUE,
+		'embedLocalOnly'		=> FALSE
 	);
 	
 	/**
@@ -113,6 +115,11 @@ class _Editor extends FormAbstract
 			}
 			
 			$this->extension = $extensions[ $args[3]['key'] ];
+			
+			if ( method_exists( $this->extension, 'embedLocalOnly' ) )
+			{
+				$args[3]['embedLocalOnly'] = $this->extension->embedLocalOnly();
+			}
 		}
 		
 		/* Don't minimize if we have a value */
@@ -251,8 +258,8 @@ class _Editor extends FormAbstract
 			$value	= \IPS\Text\Parser::mungeResources( $value );
 		}
 		
-		/* Fix Emoji */
-		\IPS\Output::i()->replaceEmojiWithImages( $value );
+		/* Fix Emoji */		
+		$value = \IPS\Output::i()->replaceEmojiWithImages( $value );
 		
 		/* CKEditor will replace <p></p> (which doesn't display anything in a normal post) with <p><br></p> (which does)
 			which creates a discrepency between wheat displays in a post and what displays in the editor */
@@ -345,7 +352,7 @@ class _Editor extends FormAbstract
 			$parser = $this->_getParser();
 			$value = $parser->parse( $value );
 		}
-													
+
 		/* Add any attachments that weren't inserted in the content */
 		if ( $this->uploader )
 		{
@@ -618,6 +625,9 @@ class _Editor extends FormAbstract
 			/* Handle delete calls */
 			if ( isset( \IPS\Request::i()->postKey ) and \IPS\Request::i()->postKey == $this->postKey and isset( \IPS\Request::i()->deleteFile ) )
 			{
+				/* CSRF check */
+				\IPS\Session::i()->csrfCheck();
+				
 				/* Get the attachment */
 				try
 				{