From 374d0b47027ef7c752f52d6e3414aa7597682e2f Mon Sep 17 00:00:00 2001 From: Juan Leyva Date: Tue, 27 Aug 2019 13:35:21 +0100 Subject: [PATCH] MDL-66501 tool_mobile: Prevent URLs in custom scheme --- admin/tool/mobile/launch.php | 2 +- admin/tool/mobile/settings.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/admin/tool/mobile/launch.php b/admin/tool/mobile/launch.php index 1e74e37fc32..2c5fc181b50 100644 --- a/admin/tool/mobile/launch.php +++ b/admin/tool/mobile/launch.php @@ -30,7 +30,7 @@ require_once($CFG->libdir . '/externallib.php'); $serviceshortname = required_param('service', PARAM_ALPHANUMEXT); $passport = required_param('passport', PARAM_RAW); // Passport send from the app to validate the response URL. -$urlscheme = optional_param('urlscheme', 'moodlemobile', PARAM_NOTAGS); // The URL scheme the app supports. +$urlscheme = optional_param('urlscheme', 'moodlemobile', PARAM_ALPHANUM); // The URL scheme the app supports. $confirmed = optional_param('confirmed', false, PARAM_BOOL); // If we are being redirected after user confirmation. $oauthsso = optional_param('oauthsso', 0, PARAM_INT); // Id of the OpenID issuer (for OAuth direct SSO). diff --git a/admin/tool/mobile/settings.php b/admin/tool/mobile/settings.php index 125a72a6929..6b5d634b36f 100644 --- a/admin/tool/mobile/settings.php +++ b/admin/tool/mobile/settings.php @@ -63,7 +63,7 @@ if ($hassiteconfig) { $temp->add(new admin_setting_configtext('tool_mobile/forcedurlscheme', new lang_string('forcedurlscheme_key', 'tool_mobile'), - new lang_string('forcedurlscheme', 'tool_mobile'), '', PARAM_NOTAGS)); + new lang_string('forcedurlscheme', 'tool_mobile'), '', PARAM_ALPHANUM)); $ADMIN->add('mobileapp', $temp);