Limits the schemes that project homepage can use (#22925).

git-svn-id: http://svn.redmine.org/redmine/trunk@15432 e93f8b46-1217-0410-a6f0-8f06a7374b81

Author: jplang

app/helpers/application_helper.rb

@@ -28,6 +28,7 @@ module ApplicationHelper
   include Redmine::SudoMode::Helper
   include Redmine::Themes::Helper
   include Redmine::Hook::Helper
+  include Redmine::Helpers::URL
 
   extend Forwardable
   def_delegators :wiki_helper, :wikitoolbar_for, :heads_for_wiki_formatter

app/views/projects/show.html.erb

@@ -26,7 +26,7 @@
   <% if @project.homepage.present? || @subprojects.any? || @project.visible_custom_field_values.any?(&:present?) %>
   <ul>
   <% unless @project.homepage.blank? %>
-    <li><span class="label"><%=l(:field_homepage)%>:</span> <%= link_to @project.homepage, @project.homepage %></li>
+    <li><span class="label"><%=l(:field_homepage)%>:</span> <%= link_to_if uri_with_safe_scheme?(@project.homepage), @project.homepage, @project.homepage %></li>
   <% end %>
   <% if @subprojects.any? %>
     <li><span class="label"><%=l(:label_subproject_plural)%>:</span>