diff --git a/zefie_wtvp_minisrv/includes/classes/WTVShared.js b/zefie_wtvp_minisrv/includes/classes/WTVShared.js index d56e4416..071be889 100644 --- a/zefie_wtvp_minisrv/includes/classes/WTVShared.js +++ b/zefie_wtvp_minisrv/includes/classes/WTVShared.js @@ -240,8 +240,16 @@ class WTVShared { var allowed = true; Object.keys(frame.attribs).forEach((k) => { if (k == "href" || k == "background" || k == "src") { - allowed = false; - var value = frame.attribs[k]; + allowed = false; + var value = frame.attribs[k]; + + if (frame.tag !== "a") { + // check everything except normal links + if (value.startsWith("wtvchat") || value.startsWith("irc")) { + // don't allow irc embeds + return false; + } + } Object.keys(allowedProtocols).forEach((j) => { if (value.startsWith(allowedProtocols[j])) { allowed = true;