From 2ea89b98a75b79144ebe482c6b74b5e32658ff64 Mon Sep 17 00:00:00 2001
From: Tim Hunt <T.J.Hunt@open.ac.uk>
Date: Fri, 6 Jan 2023 12:55:40 +0000
Subject: [PATCH] MDL-76810 redirect handling: ensure return URLs are properly
 sanitised

---
 backup/backupfilesedit_form.php           | 2 +-
 blog/external_blog_edit_form.php          | 2 +-
 course/switchrole.php                     | 4 ++--
 mod/wiki/filesedit_form.php               | 2 +-
 question/bank/history/history.php         | 2 +-
 question/bank/previewquestion/preview.php | 2 +-
 user/action_redir.php                     | 2 +-
 7 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/backup/backupfilesedit_form.php b/backup/backupfilesedit_form.php
index 3f3d014cac2..1c6ed588a7e 100644
--- a/backup/backupfilesedit_form.php
+++ b/backup/backupfilesedit_form.php
@@ -48,7 +48,7 @@ class backup_files_edit_form extends moodleform {
         $mform->setType('component', PARAM_COMPONENT);
 
         $mform->addElement('hidden', 'returnurl', $this->_customdata['returnurl']);
-        $mform->setType('returnurl', PARAM_URL);
+        $mform->setType('returnurl', PARAM_LOCALURL);
 
         $this->add_action_buttons(true, get_string('savechanges'));
         $this->set_data($this->_customdata['data']);
diff --git a/blog/external_blog_edit_form.php b/blog/external_blog_edit_form.php
index 2e0dcb7cefc..bb3de693ece 100644
--- a/blog/external_blog_edit_form.php
+++ b/blog/external_blog_edit_form.php
@@ -64,7 +64,7 @@ class blog_edit_external_form extends moodleform {
         $mform->setDefault('id', 0);
 
         $mform->addElement('hidden', 'returnurl');
-        $mform->setType('returnurl', PARAM_URL);
+        $mform->setType('returnurl', PARAM_LOCALURL);
         $mform->setDefault('returnurl', 0);
     }
 
diff --git a/course/switchrole.php b/course/switchrole.php
index a54f8ad5812..bb2e224648b 100644
--- a/course/switchrole.php
+++ b/course/switchrole.php
@@ -34,7 +34,7 @@ require_once($CFG->dirroot.'/course/lib.php');
 
 $id         = required_param('id', PARAM_INT);
 $switchrole = optional_param('switchrole', -1, PARAM_INT);
-$returnurl  = optional_param('returnurl', '', PARAM_RAW);
+$returnurl  = optional_param('returnurl', '', PARAM_LOCALURL);
 
 if (strpos($returnurl, '?') === false) {
     // Looks like somebody did not set proper page url, better go to course page.
@@ -43,7 +43,7 @@ if (strpos($returnurl, '?') === false) {
     if (strpos($returnurl, $CFG->wwwroot) !== 0) {
         $returnurl = $CFG->wwwroot.$returnurl;
     }
-    $returnurl  = clean_param($returnurl, PARAM_URL);
+    $returnurl  = clean_param($returnurl, PARAM_LOCALURL);
 }
 
 $PAGE->set_url('/course/switchrole.php', array('id'=>$id, 'switchrole'=>$switchrole));
diff --git a/mod/wiki/filesedit_form.php b/mod/wiki/filesedit_form.php
index a11ac651620..d449018b613 100644
--- a/mod/wiki/filesedit_form.php
+++ b/mod/wiki/filesedit_form.php
@@ -36,7 +36,7 @@ class mod_wiki_filesedit_form extends moodleform {
         $mform->addElement('filemanager', 'files_filemanager', get_string('files'), null, $options);
 
         $mform->addElement('hidden', 'returnurl', $data->returnurl);
-        $mform->setType('returnurl', PARAM_URL);
+        $mform->setType('returnurl', PARAM_LOCALURL);
 
         $mform->addElement('hidden', 'subwiki', $data->subwikiid);
         $mform->setType('subwiki', PARAM_INT);
diff --git a/question/bank/history/history.php b/question/bank/history/history.php
index f4e12a2f7ab..41ace41c54c 100644
--- a/question/bank/history/history.php
+++ b/question/bank/history/history.php
@@ -30,7 +30,7 @@ require_login();
 core_question\local\bank\helper::require_plugin_enabled('qbank_history');
 
 $entryid = required_param('entryid', PARAM_INT);
-$returnurl = required_param('returnurl', PARAM_RAW);
+$returnurl = required_param('returnurl', PARAM_LOCALURL);
 
 list($thispageurl, $contexts, $cmid, $cm, $module, $pagevars) =
         question_edit_setup('questions', '/question/bank/history/history.php');
diff --git a/question/bank/previewquestion/preview.php b/question/bank/previewquestion/preview.php
index 4c6156cfdcd..b89616fdb8c 100644
--- a/question/bank/previewquestion/preview.php
+++ b/question/bank/previewquestion/preview.php
@@ -48,7 +48,7 @@ define('QUESTION_PREVIEW_MAX_VARIANTS', 100);
 
 // Get and validate question id.
 $id = required_param('id', PARAM_INT);
-$returnurl = optional_param('returnurl', null, PARAM_RAW);
+$returnurl = optional_param('returnurl', null, PARAM_LOCALURL);
 
 $question = question_bank::load_question($id);
 
diff --git a/user/action_redir.php b/user/action_redir.php
index 41beff00e91..e17c4d0582e 100644
--- a/user/action_redir.php
+++ b/user/action_redir.php
@@ -61,7 +61,7 @@ if ($formaction == 'bulkchange.php') {
 
     $userids = optional_param_array('userid', array(), PARAM_INT);
     $default = new moodle_url('/user/index.php', ['id' => $course->id]);
-    $returnurl = new moodle_url(optional_param('returnto', $default, PARAM_URL));
+    $returnurl = new moodle_url(optional_param('returnto', $default, PARAM_LOCALURL));
 
     if (empty($userids)) {
         $userids = optional_param_array('bulkuser', array(), PARAM_INT);