From 3ce42559d3ca8404ba352986ee67f4b30ee01ded Mon Sep 17 00:00:00 2001
From: skodak <skodak>
Date: Wed, 16 Nov 2005 16:47:17 +0000
Subject: [PATCH] added basic validation of jump parameter; merged from
 MOODLE_15_STABLE

---
 course/jumpto.php | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/course/jumpto.php b/course/jumpto.php
index 819681377a2..2a5ae23874d 100644
--- a/course/jumpto.php
+++ b/course/jumpto.php
@@ -1,19 +1,23 @@
 <?php  // $Id$
-       
+
 /*
- *  Jumps to a given URL.  Mostly used for accessibility.
+ *  Jumps to a given relative or Moodle absolute URL.
+ *  Mostly used for accessibility.
  *
  */
 
     require('../config.php');
 
-//TODO: fix redirect before enabling - SC#189
-/*    $jump = optional_param('jump', '');
+    $jump = optional_param('jump', '', PARAM_RAW);
 
-    if ($jump) {
+    if (strpos($jump, $CFG->wwwroot) === 0) {
         redirect(urldecode($jump));
-    }*/
-
-    redirect($_SERVER['HTTP_REFERER']);
+    } else {
+        if (preg_match('/^[a-z]+\.php\?/', $jump)) {
+            redirect(urldecode($jump));
+        } else {
+            redirect($_SERVER['HTTP_REFERER']);
+        }
+    }
 
 ?>