mirror_php/moodle
1
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-06-02 22:25:04 +02:00
Code Issues Projects Releases Wiki Activity

MDL-44605 calendar: improved returnurl validation

Browse Source 
Now we will only redirect to a local url (though sesskey was
already preventing this redirect from being open)
This commit is contained in:
Dan Poltawski 2014-07-03 14:30:36 +01:00 committed by Eloy Lafuente (stronk7)
parent b77130af5e
commit abc5f84539
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
calendar/lib.php
View File

@ -1018,7 +1018,7 @@ function calendar_filter_controls(moodle_url $returnurl) {
$groupevents = true;
$id = optional_param( 'id',0,PARAM_INT );
$seturl = new moodle_url('/calendar/set.php', array('return' => base64_encode($returnurl->out(false)), 'sesskey'=>sesskey()));
$seturl = new moodle_url('/calendar/set.php', array('return' => base64_encode($returnurl->out_as_local_url(false)), 'sesskey'=>sesskey()));
$content = html_writer::start_tag('ul');
$seturl->param('var', 'showglobal');

4
calendar/set.php
View File

@ -44,14 +44,14 @@ require_once($CFG->dirroot.'/calendar/lib.php');
require_sesskey();
$var = required_param('var', PARAM_ALPHA);
$return = clean_param(base64_decode(required_param('return', PARAM_RAW)), PARAM_URL);
$return = clean_param(base64_decode(required_param('return', PARAM_RAW)), PARAM_LOCALURL);
$courseid = optional_param('id', -1, PARAM_INT);
if ($courseid != -1) {
$return = new moodle_url($return, array('course' => $courseid));
} else {
$return = new moodle_url($return);
}
$url = new moodle_url('/calendar/set.php', array('return'=>base64_encode($return->out(false)), 'course' => $courseid, 'var'=>$var, 'sesskey'=>sesskey()));
$url = new moodle_url('/calendar/set.php', array('return'=>base64_encode($return->out_as_local_url(false)), 'course' => $courseid, 'var'=>$var, 'sesskey'=>sesskey()));
$PAGE->set_url($url);
$PAGE->set_context(context_system::instance());