MDL-64651 comments: Do not send referrer

Use blanktarget option on all comments to prevent malicious links.
2019-03-05 04:16:40 +01:00
parent cd3060d941
commit 1fc481dd7b
3 changed files with 7 additions and 4 deletions
@@ -102,6 +102,7 @@ class core_comment_external extends external_api {
        if ($comments === false) {
            throw new moodle_exception('nopermissions', 'error', '', 'view comments');
        }
+        $options = array('blanktarget' => true);

        foreach ($comments as $key => $comment) {

@@ -110,7 +111,8 @@ class core_comment_external extends external_api {
                                                                                                 $context->id,
                                                                                                 $params['component'],
                                                                                                 '',
-                                                                                                 0);
+                                                                                                 0,
+                                                                                                 $options);
        }

        $results = array(