From 3dbed6740aa131b033bfa106187fdbecf4118365 Mon Sep 17 00:00:00 2001 From: Eric Merrill Date: Mon, 3 Nov 2025 09:26:44 +0700 Subject: [PATCH] MDL-80317 auth_oauth2: Restrict login redirect to local url --- public/auth/oauth2/login.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/public/auth/oauth2/login.php b/public/auth/oauth2/login.php index 20b6c6d234c..c2d39169d30 100644 --- a/public/auth/oauth2/login.php +++ b/public/auth/oauth2/login.php @@ -25,7 +25,7 @@ require_once('../../config.php'); $issuerid = required_param('id', PARAM_INT); -$wantsurl = optional_param('wantsurl', '', PARAM_URL); +$wantsurl = optional_param('wantsurl', '', PARAM_LOCALURL); $PAGE->set_context(context_system::instance()); $PAGE->set_url(new moodle_url('/auth/oauth2/login.php', ['id' => $issuerid]));