more signature sanity checking

- allows A links to wtvchat and irc, but not any form of embedding (img bgsound etc)

zefie_wtvp_minisrv/includes/classes/WTVShared.js

@@ -242,6 +242,14 @@ class WTVShared {
                     if (k == "href" || k == "background" || k == "src") {
                         allowed = false;    
                         var value = frame.attribs[k];
+
+                        if (frame.tag !== "a") {
+                            // check everything except normal links
+                            if (value.startsWith("wtvchat") || value.startsWith("irc")) {
+                                // don't allow irc embeds
+                                return false;
+                            }
+                        }                  
                         Object.keys(allowedProtocols).forEach((j) => {
                             if (value.startsWith(allowedProtocols[j])) {
                                 allowed = true;