Merge branch 'only-urls-allowed' into 'rails'

Solo permitir URLs web al sanitizar

Closes #2382

See merge request sutty/sutty!54

app/models/metadata_content.rb

@@ -56,7 +56,7 @@ class MetadataContent < MetadataTemplate
         uri = URI element['src']
 
         # No permitimos recursos externos
-        element.remove unless uri.hostname.end_with? Site.domain
+        element.remove unless uri.scheme == 'https' && uri.hostname.end_with?(Site.domain)
       rescue URI::Error
         element.remove
       end