diff --git a/auth/ldap/auth.php b/auth/ldap/auth.php
index 6090ebd7712..c2beb4f658f 100644
--- a/auth/ldap/auth.php
+++ b/auth/ldap/auth.php
@@ -1642,7 +1642,7 @@ class auth_plugin_ldap extends auth_plugin_base {
if (($_SERVER['REQUEST_METHOD'] === 'GET' // Only on initial GET of loginpage
|| ($_SERVER['REQUEST_METHOD'] === 'POST'
- && (get_referer() != strip_querystring(qualified_me()))))
+ && (get_local_referer() != strip_querystring(qualified_me()))))
// Or when POSTed from another place
// See MDL-14071
&& !empty($this->config->ntlmsso_enabled) // SSO enabled
@@ -1653,13 +1653,15 @@ class auth_plugin_ldap extends auth_plugin_base {
// First, let's remember where we were trying to get to before we got here
if (empty($SESSION->wantsurl)) {
- $SESSION->wantsurl = (array_key_exists('HTTP_REFERER', $_SERVER) &&
- $_SERVER['HTTP_REFERER'] != $CFG->wwwroot &&
- $_SERVER['HTTP_REFERER'] != $CFG->wwwroot.'/' &&
- $_SERVER['HTTP_REFERER'] != $CFG->httpswwwroot.'/login/' &&
- $_SERVER['HTTP_REFERER'] != $CFG->httpswwwroot.'/login/index.php' &&
- clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL) != '')
- ? $_SERVER['HTTP_REFERER'] : NULL;
+ $SESSION->wantsurl = null;
+ $referer = get_safe_referer(false);
+ if ($referer &&
+ $referer != $CFG->wwwroot &&
+ $referer != $CFG->wwwroot . '/' &&
+ $referer != $CFG->httpswwwroot . '/login/' &&
+ $referer != $CFG->httpswwwroot . '/login/index.php') {
+ $SESSION->wantsurl = $referer;
+ }
}
// Now start the whole NTLM machinery.
diff --git a/course/togglecompletion.php b/course/togglecompletion.php
index 075134fe8d8..f0c77c96b9c 100644
--- a/course/togglecompletion.php
+++ b/course/togglecompletion.php
@@ -78,7 +78,7 @@ if ($courseid) {
}
// Return to previous page
- $referer = clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL);
+ $referer = get_local_referer(false);
if (!empty($referer)) {
redirect($referer);
} else {
diff --git a/enrol/index.php b/enrol/index.php
index 5e3d331611a..dcc4d9639b9 100644
--- a/enrol/index.php
+++ b/enrol/index.php
@@ -29,7 +29,7 @@ $id = required_param('id', PARAM_INT);
$returnurl = optional_param('returnurl', 0, PARAM_LOCALURL);
if (!isloggedin()) {
- $referer = clean_param(get_referer(), PARAM_LOCALURL);
+ $referer = get_local_referer();
if (empty($referer)) {
// A user that is not logged in has arrived directly on this page,
// they should be redirected to the course page they are trying to enrol on after logging in.
@@ -108,7 +108,7 @@ if (!$forms) {
} else if ($returnurl) {
notice(get_string('notenrollable', 'enrol'), $returnurl);
} else {
- $url = clean_param(get_referer(false), PARAM_LOCALURL);
+ $url = get_local_referer(false);
if (empty($url)) {
$url = new moodle_url('/index.php');
}
diff --git a/error/index.php b/error/index.php
index 54f0b53e22b..721f141841a 100644
--- a/error/index.php
+++ b/error/index.php
@@ -29,7 +29,7 @@
$site = get_site();
$redirecturl = empty($_SERVER['REDIRECT_URL']) ? '' : $_SERVER['REDIRECT_URL'];
- $httpreferer = empty($_SERVER['HTTP_REFERER']) ? '' : $_SERVER['HTTP_REFERER'];
+ $httpreferer = get_local_referer(false);
$requesturi = empty($_SERVER['REQUEST_URI']) ? '' : $_SERVER['REQUEST_URI'];
header("HTTP/1.0 404 Not Found");
diff --git a/lib/classes/session/manager.php b/lib/classes/session/manager.php
index 8dfc9ceaf25..b1a5e16ed1f 100644
--- a/lib/classes/session/manager.php
+++ b/lib/classes/session/manager.php
@@ -380,11 +380,12 @@ class manager {
if (is_web_crawler()) {
$user = guest_user();
}
- if (!empty($CFG->guestloginbutton) and !$user and !empty($_SERVER['HTTP_REFERER'])) {
+ $referer = get_local_referer(false);
+ if (!empty($CFG->guestloginbutton) and !$user and !empty($referer)) {
// Automatically log in users coming from search engine results.
- if (strpos($_SERVER['HTTP_REFERER'], 'google') !== false ) {
+ if (strpos($referer, 'google') !== false ) {
$user = guest_user();
- } else if (strpos($_SERVER['HTTP_REFERER'], 'altavista') !== false ) {
+ } else if (strpos($referer, 'altavista') !== false ) {
$user = guest_user();
}
}
diff --git a/lib/moodlelib.php b/lib/moodlelib.php
index 771c57821d7..9f236b37310 100644
--- a/lib/moodlelib.php
+++ b/lib/moodlelib.php
@@ -2549,8 +2549,10 @@ function require_login($courseorid = null, $autologinguest = true, $cm = null, $
if ($setwantsurltome) {
$SESSION->wantsurl = qualified_me();
}
- if (!empty($_SERVER['HTTP_REFERER'])) {
- $SESSION->fromurl = $_SERVER['HTTP_REFERER'];
+
+ $referer = get_local_referer(false);
+ if (!empty($referer)) {
+ $SESSION->fromurl = $referer;
}
// Give auth plugins an opportunity to authenticate or redirect to an external login page
diff --git a/lib/weblib.php b/lib/weblib.php
index 3c7d44e4c03..bd3689b3313 100644
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -216,6 +216,25 @@ function is_https() {
return (strpos($CFG->httpswwwroot, 'https://') === 0);
}
+/**
+ * Returns the cleaned local URL of the HTTP_REFERER less the URL query string parameters if required.
+ *
+ * @param bool $stripquery if true, also removes the query part of the url.
+ * @return string The resulting referer or empty string.
+ */
+function get_local_referer($stripquery = true) {
+ if (isset($_SERVER['HTTP_REFERER'])) {
+ $referer = clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL);
+ if ($stripquery) {
+ return strip_querystring($referer);
+ } else {
+ return $referer;
+ }
+ } else {
+ return '';
+ }
+}
+
/**
* Class for creating and manipulating urls.
*
diff --git a/login/index.php b/login/index.php
index f610ce86a30..287d3da7116 100644
--- a/login/index.php
+++ b/login/index.php
@@ -258,15 +258,16 @@ if ($session_has_timed_out and !data_submitted()) {
/// First, let's remember where the user was trying to get to before they got here
if (empty($SESSION->wantsurl)) {
- $SESSION->wantsurl = (array_key_exists('HTTP_REFERER',$_SERVER) &&
- $_SERVER["HTTP_REFERER"] != $CFG->wwwroot &&
- $_SERVER["HTTP_REFERER"] != $CFG->wwwroot.'/' &&
- $_SERVER["HTTP_REFERER"] != $CFG->httpswwwroot.'/login/' &&
- strpos($_SERVER["HTTP_REFERER"], $CFG->httpswwwroot.'/login/?') !== 0 &&
- strpos($_SERVER["HTTP_REFERER"], $CFG->httpswwwroot.'/login/index.php') !== 0 &&
- clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL) != '')
- // There might be some extra params such as ?lang=.
- ? $_SERVER["HTTP_REFERER"] : NULL;
+ $SESSION->wantsurl = null;
+ $referer = get_local_referer(false);
+ if ($referer &&
+ $referer != $CFG->wwwroot &&
+ $referer != $CFG->wwwroot . '/' &&
+ $referer != $CFG->httpswwwroot . '/login/' &&
+ strpos($referer, $CFG->httpswwwroot . '/login/?') !== 0 &&
+ strpos($referer, $CFG->httpswwwroot . '/login/index.php') !== 0) { // There might be some extra params such as ?lang=.
+ $SESSION->wantsurl = $referer;
+ }
}
/// Redirect to alternative login URL if needed
diff --git a/mod/choice/view.php b/mod/choice/view.php
index f8c4a3885e0..500db553788 100644
--- a/mod/choice/view.php
+++ b/mod/choice/view.php
@@ -178,7 +178,7 @@ if (!$choiceformshown) {
} else if (!is_enrolled($context)) {
// Only people enrolled can make a choice
$SESSION->wantsurl = qualified_me();
- $SESSION->enrolcancel = clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL);
+ $SESSION->enrolcancel = get_local_referer(false);
$coursecontext = context_course::instance($course->id);
$courseshortname = format_string($course->shortname, true, array('context' => $coursecontext));
diff --git a/mod/forum/lib.php b/mod/forum/lib.php
index 0953d997e46..0742c85790c 100644
--- a/mod/forum/lib.php
+++ b/mod/forum/lib.php
@@ -3930,7 +3930,7 @@ function forum_set_return() {
global $CFG, $SESSION;
if (! isset($SESSION->fromdiscussion)) {
- $referer = clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL);
+ $referer = get_local_referer(false);
// If the referer is NOT a login screen then save it.
if (! strncasecmp("$CFG->wwwroot/login", $referer, 300)) {
$SESSION->fromdiscussion = $referer;
diff --git a/mod/forum/markposts.php b/mod/forum/markposts.php
index e6f2b33e2f6..1706c6a1585 100644
--- a/mod/forum/markposts.php
+++ b/mod/forum/markposts.php
@@ -98,7 +98,7 @@ if ($mark == 'read') {
// if (forum_tp_start_tracking($forum->id, $user->id)) {
// redirect($returnto, get_string("nowtracking", "forum", $info), 1);
// } else {
-// print_error("Could not start tracking that forum", $_SERVER["HTTP_REFERER"]);
+// print_error("Could not start tracking that forum", get_local_referer());
// }
}
diff --git a/mod/forum/post.php b/mod/forum/post.php
index 2153cf6e283..bd6bc18235d 100644
--- a/mod/forum/post.php
+++ b/mod/forum/post.php
@@ -53,7 +53,7 @@ $sitecontext = context_system::instance();
if (!isloggedin() or isguestuser()) {
- if (!isloggedin() and !get_referer()) {
+ if (!isloggedin() and !get_local_referer()) {
// No referer+not logged in - probably coming in via email See MDL-9052
require_login();
}
@@ -87,7 +87,7 @@ if (!isloggedin() or isguestuser()) {
$PAGE->set_context($modcontext);
$PAGE->set_title($course->shortname);
$PAGE->set_heading($course->fullname);
- $referer = clean_param(get_referer(false), PARAM_LOCALURL);
+ $referer = get_local_referer(false);
echo $OUTPUT->header();
echo $OUTPUT->confirm(get_string('noguestpost', 'forum').'
'.get_string('liketologin'), get_login_url(), $referer);
@@ -117,7 +117,7 @@ if (!empty($forum)) { // User is starting a new discussion in a forum
if (!is_enrolled($coursecontext)) {
if (enrol_selfenrol_available($course->id)) {
$SESSION->wantsurl = qualified_me();
- $SESSION->enrolcancel = clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL);
+ $SESSION->enrolcancel = get_local_referer(false);
redirect(new moodle_url('/enrol/index.php', array('id' => $course->id,
'returnurl' => '/mod/forum/view.php?f=' . $forum->id)),
get_string('youneedtoenrol'));
@@ -131,11 +131,7 @@ if (!empty($forum)) { // User is starting a new discussion in a forum
print_error("activityiscurrentlyhidden");
}
- if (isset($_SERVER["HTTP_REFERER"])) {
- $SESSION->fromurl = $_SERVER["HTTP_REFERER"];
- } else {
- $SESSION->fromurl = '';
- }
+ $SESSION->fromurl = get_local_referer(false);
// Load up the $post variable.
@@ -188,7 +184,7 @@ if (!empty($forum)) { // User is starting a new discussion in a forum
if (!isguestuser()) {
if (!is_enrolled($coursecontext)) { // User is a guest here!
$SESSION->wantsurl = qualified_me();
- $SESSION->enrolcancel = clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL);
+ $SESSION->enrolcancel = get_local_referer(false);
redirect(new moodle_url('/enrol/index.php', array('id' => $course->id,
'returnurl' => '/mod/forum/view.php?f=' . $forum->id)),
get_string('youneedtoenrol'));
diff --git a/mod/forum/settracking.php b/mod/forum/settracking.php
index 004825f6bee..ee062bce160 100644
--- a/mod/forum/settracking.php
+++ b/mod/forum/settracking.php
@@ -66,7 +66,7 @@ if (forum_tp_is_tracked($forum) ) {
$event->trigger();
redirect($returnto, get_string("nownottracking", "forum", $info), 1);
} else {
- print_error('cannottrack', '', $_SERVER["HTTP_REFERER"]);
+ print_error('cannottrack', '', get_local_referer(false));
}
} else { // subscribe
@@ -75,7 +75,7 @@ if (forum_tp_is_tracked($forum) ) {
$event->trigger();
redirect($returnto, get_string("nowtracking", "forum", $info), 1);
} else {
- print_error('cannottrack', '', $_SERVER["HTTP_REFERER"]);
+ print_error('cannottrack', '', get_local_referer(false));
}
}
diff --git a/mod/forum/subscribe.php b/mod/forum/subscribe.php
index a18010c4609..7bd84140459 100644
--- a/mod/forum/subscribe.php
+++ b/mod/forum/subscribe.php
@@ -176,23 +176,23 @@ if ($issubscribed) {
if (\mod_forum\subscriptions::unsubscribe_user($user->id, $forum, $context, true)) {
redirect($returnto, get_string("nownotsubscribed", "forum", $info), 1);
} else {
- print_error('cannotunsubscribe', 'forum', $_SERVER["HTTP_REFERER"]);
+ print_error('cannotunsubscribe', 'forum', get_local_referer(false));
}
} else {
if (\mod_forum\subscriptions::unsubscribe_user_from_discussion($user->id, $discussion, $context)) {
$info->discussion = $discussion->name;
redirect($returnto, get_string("discussionnownotsubscribed", "forum", $info), 1);
} else {
- print_error('cannotunsubscribe', 'forum', $_SERVER["HTTP_REFERER"]);
+ print_error('cannotunsubscribe', 'forum', get_local_referer(false));
}
}
} else { // subscribe
if (\mod_forum\subscriptions::subscription_disabled($forum) && !has_capability('mod/forum:managesubscriptions', $context)) {
- print_error('disallowsubscribe', 'forum', $_SERVER["HTTP_REFERER"]);
+ print_error('disallowsubscribe', 'forum', get_local_referer(false));
}
if (!has_capability('mod/forum:viewdiscussion', $context)) {
- print_error('noviewdiscussionspermission', 'forum', $_SERVER["HTTP_REFERER"]);
+ print_error('noviewdiscussionspermission', 'forum', get_local_referer(false));
}
if (is_null($sesskey)) {
// We came here via link in email.
diff --git a/mod/quiz/renderer.php b/mod/quiz/renderer.php
index 9772d452c2c..b5173a2e6b5 100644
--- a/mod/quiz/renderer.php
+++ b/mod/quiz/renderer.php
@@ -850,7 +850,7 @@ class mod_quiz_renderer extends plugin_renderer_base {
$output .= $this->view_information($quiz, $cm, $context, $messages);
$guestno = html_writer::tag('p', get_string('guestsno', 'quiz'));
$liketologin = html_writer::tag('p', get_string('liketologin'));
- $referer = clean_param(get_referer(false), PARAM_LOCALURL);
+ $referer = get_local_referer(false);
$output .= $this->confirm($guestno."\n\n".$liketologin."\n", get_login_url(), $referer);
return $output;
}
diff --git a/mod/resource/view.php b/mod/resource/view.php
index a40995987ee..bc55f031870 100644
--- a/mod/resource/view.php
+++ b/mod/resource/view.php
@@ -89,7 +89,7 @@ if ($displaytype == RESOURCELIB_DISPLAY_OPEN || $displaytype == RESOURCELIB_DISP
// For 'open' and 'download' links, we always redirect to the content - except
// if the user just chose 'save and display' from the form then that would be
// confusing
- if (!isset($_SERVER['HTTP_REFERER']) || strpos($_SERVER['HTTP_REFERER'], 'modedit.php') === false) {
+ if (strpos(get_local_referer(false), 'modedit.php') === false) {
$redirect = true;
}
}
diff --git a/mod/survey/save.php b/mod/survey/save.php
index 0cf2613d746..a98013b2ab5 100644
--- a/mod/survey/save.php
+++ b/mod/survey/save.php
@@ -70,7 +70,7 @@
echo $OUTPUT->heading($survey->name);
if (survey_already_done($survey->id, $USER->id)) {
- notice(get_string("alreadysubmitted", "survey"), clean_param($_SERVER["HTTP_REFERER"], PARAM_LOCALURL));
+ notice(get_string("alreadysubmitted", "survey"), get_local_referer(false));
exit;
}
diff --git a/mod/url/view.php b/mod/url/view.php
index 03ad7471395..4ca31318780 100644
--- a/mod/url/view.php
+++ b/mod/url/view.php
@@ -68,7 +68,7 @@ $displaytype = url_get_final_display_type($url);
if ($displaytype == RESOURCELIB_DISPLAY_OPEN) {
// For 'open' links, we always redirect to the content - except if the user
// just chose 'save and display' from the form then that would be confusing
- if (!isset($_SERVER['HTTP_REFERER']) || strpos($_SERVER['HTTP_REFERER'], 'modedit.php') === false) {
+ if (strpos(get_local_referer(false), 'modedit.php') === false) {
$redirect = true;
}
}
diff --git a/mod/wiki/filesedit.php b/mod/wiki/filesedit.php
index d890fe9b9f6..be2fd74ff73 100644
--- a/mod/wiki/filesedit.php
+++ b/mod/wiki/filesedit.php
@@ -60,7 +60,7 @@ if (!wiki_user_can_view($subwiki, $wiki)) {
require_capability('mod/wiki:managefiles', $context);
if (empty($returnurl)) {
- $referer = clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL);
+ $referer = get_local_referer(false);
if (!empty($referer)) {
$returnurl = $referer;
} else {
diff --git a/user/view.php b/user/view.php
index 80711c799e3..f2cdcd669ee 100644
--- a/user/view.php
+++ b/user/view.php
@@ -112,7 +112,7 @@ if ($currentuser) {
// Need to have full access to a course to see the rest of own info.
echo $OUTPUT->header();
echo $OUTPUT->heading(get_string('notenrolled', '', $fullname));
- $referer = clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL);
+ $referer = get_local_referer(false);
if (!empty($referer)) {
echo $OUTPUT->continue_button($referer);
}
@@ -144,7 +144,7 @@ if ($currentuser) {
$PAGE->navbar->add($struser);
echo $OUTPUT->heading(get_string('notenrolledprofile'));
}
- $referer = clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL);
+ $referer = get_local_referer(false);
if (!empty($referer)) {
echo $OUTPUT->continue_button($referer);
}