more signature sanity checking

- allows A links to wtvchat and irc, but not any form of embedding (img bgsound etc)

zefie_wtvp_minisrv/includes/classes/WTVShared.js

@@ -240,8 +240,16 @@ class WTVShared {
                 var allowed = true;
                 Object.keys(frame.attribs).forEach((k) => {
                     if (k == "href" || k == "background" || k == "src") {
-                        allowed = false;
-                        var value = frame.attribs[k];                        
+                        allowed = false;    
+                        var value = frame.attribs[k];
+
+                        if (frame.tag !== "a") {
+                            // check everything except normal links
+                            if (value.startsWith("wtvchat") || value.startsWith("irc")) {
+                                // don't allow irc embeds
+                                return false;
+                            }
+                        }                  
                         Object.keys(allowedProtocols).forEach((j) => {
                             if (value.startsWith(allowedProtocols[j])) {
                                 allowed = true;