security: improve Javascript RST sandbox to also catch mixed case.

rhodecode/lib/markup_renderer.py

@@ -60,7 +60,9 b' class CustomHTMLTranslator(writers.html4'
             refuri = node['refuri']
             if ':' in refuri:
                 prefix, link = refuri.lstrip().split(':', 1)
-                if prefix == 'javascript':
+                prefix = prefix or ''
+
+                if prefix.lower() == 'javascript':
                     # we don't allow javascript type of refs...
                     node['refuri'] = 'javascript:alert("SandBoxedJavascript")'