mirror_php/moodle
1
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-04-22 00:42:54 +02:00
Code Issues Projects Releases Wiki Activity

MDL-59273 core: Remove mailto links support in clean_param.

Browse Source
This commit is contained in:
Ruslan Kabalin 2017-06-16 16:12:09 +01:00
parent 229ae617c5
commit e5ece45e84
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/moodlelib.php
View File

@ -1033,10 +1033,11 @@ function clean_param($param, $type) {
}
return $param;
case PARAM_URL: // Allow safe ftp, http, mailto urls.
case PARAM_URL:
// Allow safe urls.
$param = fix_utf8($param);
include_once($CFG->dirroot . '/lib/validateurlsyntax.php');
if (!empty($param) && validateUrlSyntax($param, 's?H?S?F?E?u-P-a?I?p?f?q?r?')) {
if (!empty($param) && validateUrlSyntax($param, 's?H?S?F?E-u-P-a?I?p?f?q?r?')) {
// All is ok, param is respected.
} else {
// Not really ok.

3
lib/tests/moodlelib_test.php
View File

@ -615,6 +615,9 @@ class core_moodlelib_testcase extends advanced_testcase {
$this->assertSame('', clean_param('rtmp://example.com/livestream', PARAM_URL));
$this->assertSame('', clean_param('rtmp://example.com/live&foo', PARAM_URL));
$this->assertSame('', clean_param('rtmp://example.com/fms&mp4:path/to/file.mp4', PARAM_URL));
$this->assertSame('', clean_param('mailto:support@moodle.org', PARAM_URL));
$this->assertSame('', clean_param('mailto:support@moodle.org?subject=Hello%20Moodle', PARAM_URL));
$this->assertSame('', clean_param('mailto:support@moodle.org?subject=Hello%20Moodle&cc=feedback@moodle.org', PARAM_URL));
}
public function test_clean_param_localurl() {