added basic validation of jump parameter; merged from MOODLE_15_STABLE

course/jumpto.php

@@ -1,19 +1,23 @@
 <?php  // $Id$
-       
+
 /*
- *  Jumps to a given URL.  Mostly used for accessibility.
+ *  Jumps to a given relative or Moodle absolute URL.
+ *  Mostly used for accessibility.
  *
  */
 
     require('../config.php');
 
-//TODO: fix redirect before enabling - SC#189
-/*    $jump = optional_param('jump', '');
+    $jump = optional_param('jump', '', PARAM_RAW);
 
-    if ($jump) {
+    if (strpos($jump, $CFG->wwwroot) === 0) {
         redirect(urldecode($jump));
-    }*/
-
-    redirect($_SERVER['HTTP_REFERER']);
+    } else {
+        if (preg_match('/^[a-z]+\.php\?/', $jump)) {
+            redirect(urldecode($jump));
+        } else {
+            redirect($_SERVER['HTTP_REFERER']);
+        }
+    }
 
 ?>