L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-49179 mod_forum, mod_quiz: Prevent misuse of get_referer()

Browse Source
This commit is contained in:
Frederic Massart
2015-05-05 15:12:27 +01:00
committed by Dan Poltawski
parent 10c2b92448
commit 2427771714
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod/forum/post.php
+2 -1
View File
@@ -87,9 +87,10 @@ if (!isloggedin() or isguestuser()) {
$PAGE->set_context($modcontext);
$PAGE->set_title($course->shortname);
$PAGE->set_heading($course->fullname);
$referer = clean_param(get_referer(false), PARAM_LOCALURL);
echo $OUTPUT->header();
echo $OUTPUT->confirm(get_string('noguestpost', 'forum').'<br /><br />'.get_string('liketologin'), get_login_url(), get_referer(false));
echo $OUTPUT->confirm(get_string('noguestpost', 'forum').'<br /><br />'.get_string('liketologin'), get_login_url(), $referer);
echo $OUTPUT->footer();
exit;
}
mod/quiz/renderer.php
+2 -2
View File
@@ -809,8 +809,8 @@ class mod_quiz_renderer extends plugin_renderer_base {
$output .= $this->view_information($quiz, $cm, $context, $messages);
$guestno = html_writer::tag('p', get_string('guestsno', 'quiz'));
$liketologin = html_writer::tag('p', get_string('liketologin'));
$output .= $this->confirm($guestno."\n\n".$liketologin."\n", get_login_url(),
get_referer(false));
$referer = clean_param(get_referer(false), PARAM_LOCALURL);
$output .= $this->confirm($guestno."\n\n".$liketologin."\n", get_login_url(), $referer);
return $output;
}