L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-64651 comments: Do not send referrer

Browse Source 
Use blanktarget option on all comments to prevent malicious links.
This commit is contained in:
Damyon Wiese
2019-03-05 04:16:40 +01:00
committed by Jenkins
parent cd3060d941
commit 1fc481dd7b
3 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
comment/lib.php
+3 -2
View File
@@ -570,7 +570,7 @@ class comment {
$params['itemid'] = $this->itemid;
$comments = array();
$formatoptions = array('overflowdiv' => true);
$formatoptions = array('overflowdiv' => true, 'blanktarget' => true);
$rs = $DB->get_recordset_sql($sql, $params, $start, $perpage);
foreach ($rs as $u) {
$c = new stdClass();
@@ -717,7 +717,8 @@ class comment {
$newcmt->fullname = fullname($USER);
$url = new moodle_url('/user/view.php', array('id' => $USER->id, 'course' => $this->courseid));
$newcmt->profileurl = $url->out();
$newcmt->content = format_text($newcmt->content, $newcmt->format, array('overflowdiv'=>true));
$formatoptions = array('overflowdiv' => true, 'blanktarget' => true);
$newcmt->content = format_text($newcmt->content, $newcmt->format, $formatoptions);
$newcmt->avatar = $OUTPUT->user_picture($USER, array('size'=>16));
$commentlist = array($newcmt);