From 2504a9d2ec84736e60bfd4aee41afdc27f7f9626 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20S=CC=8Ckoda?= Date: Thu, 12 Sep 2013 22:30:52 +0200 Subject: [PATCH] MDL-41223 do not store any form of login URL in $SESSION->wantsurl Credit goes to Michael Milette, thanks. --- login/index.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/login/index.php b/login/index.php index 6b727b53d08..e7b29dca022 100644 --- a/login/index.php +++ b/login/index.php @@ -272,7 +272,8 @@ if (empty($SESSION->wantsurl)) { $_SERVER["HTTP_REFERER"] != $CFG->wwwroot && $_SERVER["HTTP_REFERER"] != $CFG->wwwroot.'/' && $_SERVER["HTTP_REFERER"] != $CFG->httpswwwroot.'/login/' && - $_SERVER["HTTP_REFERER"] != $CFG->httpswwwroot.'/login/index.php') + strpos($_SERVER["HTTP_REFERER"], $CFG->httpswwwroot.'/login/?') !== 0 && + strpos($_SERVER["HTTP_REFERER"], $CFG->httpswwwroot.'/login/index.php') !== 0) // There might be some extra params such as ?lang=. ? $_SERVER["HTTP_REFERER"] : NULL; }