closes #5439

public/language/en-GB/admin/settings/general.json

@@ -26,5 +26,6 @@
 	"touch-icon.upload": "Upload",
 	"touch-icon.help": "Recommended size and format: 192x192, PNG format only. If no touch icon is specified, NodeBB will fall back to using the favicon.",
 	"outgoing-links": "Outgoing Links",
-	"outgoing-links.warning-page": "Use Outgoing Links Warning Page"
+	"outgoing-links.warning-page": "Use Outgoing Links Warning Page",
+	"outgoing-links.whitelist": "Domains to whitelist for bypassing the warning page"
 }

public/src/ajaxify.js

@@ -366,8 +366,13 @@ $(document).ready(function () {
 							window.open(this.href, '_blank');
 							e.preventDefault();
 						} else if (config.useOutgoingLinksPage) {
-							ajaxify.go('outgoing?url=' + encodeURIComponent(this.href));
+							var safeUrls = config.outgoingLinksWhitelist.trim().split(/[\s,]+/g);
-							e.preventDefault();
+							var href = this.href;
+
+							if (!safeUrls.some(function(url) { return href.indexOf(url) !== -1; } )) {
+								ajaxify.go('outgoing?url=' + encodeURIComponent(href));
+								e.preventDefault();
+							}
 						}
 					}
 				}

src/controllers/api.js

@@ -64,6 +64,10 @@ apiController.getConfig = function (req, res, next) {
 	config.bootswatchSkin = meta.config.bootswatchSkin || 'noskin';
 	config.defaultBootswatchSkin = meta.config.bootswatchSkin || 'noskin';
 
+	if (config.useOutgoingLinksPage) {
+		config.outgoingLinksWhitelist = meta.config['outgoingLinks:whitelist'];
+	}
+
 	var timeagoCutoff = meta.config.timeagoCutoff === undefined ? 30 : meta.config.timeagoCutoff;
 	config.timeagoCutoff = timeagoCutoff !== '' ? Math.max(0, parseInt(timeagoCutoff, 10)) : timeagoCutoff;
 

src/views/admin/settings/general.tpl

@@ -123,6 +123,11 @@
 					<span class="mdl-switch__label"><strong>[[admin/settings/general:outgoing-links.warning-page]]</strong></span>
 				</label>
 			</div>
+
+			<div class="form-group">
+				<label for="outgoingLinks:whitelist">[[admin/settings/general:outgoing-links.whitelist]]</label>
+				<input id="outgoingLinks:whitelist" type="text" class="form-control" placeholder="subdomain.domain.com, anotherdomain.com" data-field="outgoingLinks:whitelist" />
+			</div>
 		</form>
 	</div>
 </div>