From 014f2f5d5f83fb080bc64015f12a9a35b7e6366b Mon Sep 17 00:00:00 2001 From: stevando Date: Fri, 1 Jul 2022 13:15:56 +0800 Subject: [PATCH] MDL-72171 tool_mobile: Ensure auto login URL is always local --- admin/tool/mobile/autologin.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/admin/tool/mobile/autologin.php b/admin/tool/mobile/autologin.php index 13154b3d3ef..ffc0e899c5a 100644 --- a/admin/tool/mobile/autologin.php +++ b/admin/tool/mobile/autologin.php @@ -27,7 +27,8 @@ require_once($CFG->libdir . '/externallib.php'); $userid = required_param('userid', PARAM_INT); // The user id the key belongs to (for double-checking). $key = required_param('key', PARAM_ALPHANUMEXT); // The key generated by the tool_mobile_external::get_autologin_key() external function. -$urltogo = optional_param('urltogo', $CFG->wwwroot, PARAM_URL); // URL to redirect. +$urltogo = optional_param('urltogo', $CFG->wwwroot, PARAM_LOCALURL); // URL to redirect. +$urltogo = $urltogo ?: $CFG->wwwroot; $context = context_system::instance(); $PAGE->set_context($context);