From b216ddbe68e44638bd5524283ac879c34f77ad5b Mon Sep 17 00:00:00 2001
From: Ankit Kumar Agarwal <ankit_frenz@yahoo.co.in>
Date: Mon, 17 Oct 2011 15:06:54 +0530
Subject: [PATCH] MDL-29619 Validate urls before generating output

---
 mod/url/lang/en/url.php | 1 +
 mod/url/view.php        | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/mod/url/lang/en/url.php b/mod/url/lang/en/url.php
index a39674eef9a..e62b5148337 100644
--- a/mod/url/lang/en/url.php
+++ b/mod/url/lang/en/url.php
@@ -44,6 +44,7 @@ $string['displayselect_help'] = 'This setting, together with the URL file type a
 $string['displayselectexplain'] = 'Choose display type, unfortunately not all types are suitable for all URLs.';
 $string['externalurl'] = 'External URL';
 $string['framesize'] = 'Frame height';
+$string['invalidstoredurl'] = 'Invalid URL';
 $string['chooseavariable'] = 'Choose a variable...';
 $string['invalidurl'] = 'Entered URL is invalid';
 $string['modulename'] = 'URL';
diff --git a/mod/url/view.php b/mod/url/view.php
index a18093a543b..8996c22b1fd 100644
--- a/mod/url/view.php
+++ b/mod/url/view.php
@@ -55,6 +55,12 @@ $completion->set_module_viewed($cm);
 
 $PAGE->set_url('/mod/url/view.php', array('id' => $cm->id));
 
+// Make sure URL is valid before generating output
+$url->externalurl = clean_param($url->externalurl, PARAM_URL);
+if (empty($url->externalurl)) {
+    print_error('invalidstoredurl', 'url');
+}
+
 if ($redirect) {
     // coming from course page or url index page,
     // the redirection is needed for completion tracking and logging