feat(external-links): add whitelist to bypass redirect page (#6548)

Signed-off-by: Tobias Dillig <tobias.dillig@frachtwerk.de>
Signed-off-by: Tobi <tldev-de@users.noreply.github.com>

public/docs/release-notes.md

@@ -1,5 +1,11 @@
 # Release Notes
 
+## <i class="fa fa-tag"></i> 1.x.x <i class="fa fa-calendar-o"></i> UNRELEASED
+
+### Enhancements
+
+- Added external link whitelist setting (`externalLinkWhitelist` in config.json or `CMD_EXTERNAL_LINK_WHITELIST`) to skip warning page for certain domains
+
 ## <i class="fa fa-tag"></i> 1.11.0 <i class="fa fa-calendar-o"></i> 2026-06-18
 
 ### Security fixes

public/js/extra.js

@@ -592,6 +592,7 @@ window.postProcess = postProcess
 
 // rewrite external links to go through the /_link warning page
 export function rewriteExternalLinks (view) {
+  const whitelist = window.externalLinkWhitelist || []
   view.find('a[href]').each((index, linkTag) => {
     const anchor = $(linkTag)
     const href = anchor.attr('href')
@@ -608,6 +609,14 @@ export function rewriteExternalLinks (view) {
     if (!['http:', 'https:'].includes(parsed.protocol) || parsed.origin === window.location.origin) {
       return
     }
+    // skip rewriting for whitelisted domains (exact match or subdomain, case-insensitive)
+    const hostname = parsed.hostname.toLowerCase()
+    if (whitelist.some(domain => {
+      const lowercaseDomain = domain.toLowerCase()
+      return hostname === lowercaseDomain || hostname.endsWith('.' + lowercaseDomain)
+    })) {
+      return
+    }
     const noteURL = window.location.pathname.split('/').pop()
     anchor.attr('href', `${window.location.origin}/_link?url=${encodeURIComponent(parsed.href)}&note=${noteURL}`)
   })

public/js/lib/common/constant.ejs

@@ -8,6 +8,8 @@ window.allowedUploadMimeTypes = <%- JSON.stringify(allowedUploadMimeTypes) %>
 
 window.linkifyHeaderStyle = '<%- linkifyHeaderStyle %>'
 
+window.externalLinkWhitelist = <%- JSON.stringify(externalLinkWhitelist) %>
+
 window.DROPBOX_APP_KEY = '<%- DROPBOX_APP_KEY %>'
 
 window.cookiePolicy = '<%- cookiePolicy %>'