Merge remote-tracking branch 'origin/rails' into staging-cd

Solo permitir URLs web al sanitizar

Closes #2382

See merge request sutty/sutty!54

.woodpecker.yml

@@ -1,18 +1,14 @@
 pipeline:
   deploy:
-    image: registry.nulo.in/sutty/haini.sh@sha256:4bce5f8edecac49d10d1057950535d2f366509b75ee30f0d39daa42dec9f09c4
+    image: registry.nulo.in/sutty/haini.sh@sha256:e28a80228476f5d79e5095e4725ae23c887f9f29ccaa3878b89b619b966eb26b
     environment:
       # ¡MOCK!
       - RAILS_MASTER_KEY=5d2d51406b25ff9c3465122d0732e72c
       # Workaround porque Woodpecker a veces lo setea a /root :/
       - HOME=/home/suttier
     commands:
-      - sudo chown suttier:suttier -R .
       - eval $(ssh-agent -s)
       - echo "$${SSH_KEY}" | tr -d '\r' | ssh-add -
-      - mkdir ~/.ssh/
-      - chmod 700 ~/.ssh
-      - echo athshe.sutty.nl ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOhlnG9AbfzYmq36vrIRViYTVf7llQtEW/SXlGRVyhqe > ~/.ssh/known_hosts
 
       - make bundle hain="sh -c"
       - echo -n z8p4KI/XRbGPdxPsNux8ys1gvL4+97DrrvPyt7gugJog3o3x/UEIyedkKUq9FWHOS9ltrsUN6NpN5Dsme+iHbMC/FrRjDmDvOoHpP/pqy924l6IgU8OK3m2Y28AU7eqiYvf6kJd5s4KmPJDiH9AQRx4QRy4jG5DfMHBew6EumqedgvRRFtAc3++GPH2qPnO8SYapRM4FXXUTjP3fNdRVD1Fqm7chUra4Qng1JhnzdMlOUhCPfD1Rmeh+X2TltzYhdPMFH3U3fJV7xCkitxu5PQgWfxMhb9FVF68Uvykbt/rod4IE6ZmAmPyyGktYuQSI2t1kkpAV4MOG4ag9aC/RLmi23rt+fVoYJREHga+NQ0YjVSGbBlINIDACr1iL+abtNmHhtfY+o9unlD7xy3UP0EdqTx6WncVJn02D--pfdBRF+zxL1uqoWs--4OJ7axQaFf9git6zUtUGOA== > config/credentials.yml.enc

app/models/metadata_content.rb

@@ -56,7 +56,7 @@ class MetadataContent < MetadataTemplate
         uri = URI element['src']
 
         # No permitimos recursos externos
-        element.remove unless uri.hostname.end_with? Site.domain
+        element.remove unless uri.scheme == 'https' && uri.hostname.end_with?(Site.domain)
       rescue URI::Error
         element.remove
       end