From 3d947610a0fde79aef850df0abb5d7ad111fd768 Mon Sep 17 00:00:00 2001
From: Frederic Massart <fmcell@gmail.com>
Date: Thu, 12 Dec 2013 11:31:51 +0100
Subject: [PATCH] MDL-38698 filter_urltolink: Do not link the URL property of
 CSS

---
 filter/urltolink/filter.php            | 9 +++++++--
 filter/urltolink/tests/filter_test.php | 5 +++++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/filter/urltolink/filter.php b/filter/urltolink/filter.php
index 290e7ed3cdf..538d03e8e4f 100644
--- a/filter/urltolink/filter.php
+++ b/filter/urltolink/filter.php
@@ -132,8 +132,13 @@ class filter_urltolink extends moodle_text_filter {
         $querystring = '(?:\?(?:[\pL0-9\.!$&\'\(\)*+,;=_~:@/?-]|%[a-fA-F0-9]{2})*)';
         $fragment = '(?:\#(?:[\pL0-9\.!$&\'\(\)*+,;=_~:@/?-]|%[a-fA-F0-9]{2})*)';
 
-        $regex = "(?<!=[\"'])$urlstart((?:$domainsegment\.)+$domainsegment|$numericip)" .
-                "($port?$path$querystring?$fragment?)(?<![]),.;])";
+        // Lookbehind assertions.
+        // Is not HTML attribute or CSS URL property. Unfortunately legit text like "url(http://...)" will not be a link.
+        $lookbehindstart = "(?<!=[\"']|\burl\([\"' ]|\burl\()";
+        $lookbehindend = "(?<![]),.;])";
+
+        $regex = "$lookbehindstart$urlstart((?:$domainsegment\.)+$domainsegment|$numericip)" .
+                "($port?$path$querystring?$fragment?)$lookbehindend";
         if ($unicoderegexp) {
             $regex = '#' . $regex . '#ui';
         } else {
diff --git a/filter/urltolink/tests/filter_test.php b/filter/urltolink/tests/filter_test.php
index e448d2620bc..2a3842ca2d6 100644
--- a/filter/urltolink/tests/filter_test.php
+++ b/filter/urltolink/tests/filter_test.php
@@ -144,6 +144,11 @@ class filter_urltolink_testcase extends basic_testcase {
             '<td background="www.moodle.org">&nbsp;</td>' => '<td background="www.moodle.org">&nbsp;</td>',
             '<form name="input" action="http://moodle.org/submit.asp" method="get">'=>'<form name="input" action="http://moodle.org/submit.asp" method="get">',
             '<td background="https://www.moodle.org">&nbsp;</td>' => '<td background="https://www.moodle.org">&nbsp;</td>',
+            // CSS URLs.
+            '<table style="background-image: url(\'http://moodle.org/pic.jpg\');">' => '<table style="background-image: url(\'http://moodle.org/pic.jpg\');">',
+            '<table style="background-image: url(http://moodle.org/pic.jpg);">' => '<table style="background-image: url(http://moodle.org/pic.jpg);">',
+            '<table style="background-image: url("http://moodle.org/pic.jpg");">' => '<table style="background-image: url("http://moodle.org/pic.jpg");">',
+            '<table style="background-image: url( http://moodle.org/pic.jpg );">' => '<table style="background-image: url( http://moodle.org/pic.jpg );">',
             //partially escaped img tag
             'partially escaped img tag &lt;img src="http://moodle.org/logo/logo-240x60.gif" />' => 'partially escaped img tag &lt;img src="http://moodle.org/logo/logo-240x60.gif" />',
             //fully escaped img tag. Commented out as part of MDL-21183