From 6330d48813c11f3ee48f53c2152b7957cc0cd8af Mon Sep 17 00:00:00 2001
From: Paul Holden <paulh@moodle.com>
Date: Wed, 24 Jul 2019 11:46:31 +0100
Subject: [PATCH] MDL-66228 mod_lesson: ensure return URL parameters are always
 local.

---
 mod/lesson/editpage.php | 7 +++++--
 mod/lesson/locallib.php | 4 ++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/mod/lesson/editpage.php b/mod/lesson/editpage.php
index 7f7bef8103a..1e28d9eca44 100644
--- a/mod/lesson/editpage.php
+++ b/mod/lesson/editpage.php
@@ -32,8 +32,11 @@ $pageid = required_param('pageid', PARAM_INT);
 $id     = required_param('id', PARAM_INT);         // Course Module ID
 $qtype  = optional_param('qtype', 0, PARAM_INT);
 $edit   = optional_param('edit', false, PARAM_BOOL);
-$returnto = optional_param('returnto', null, PARAM_URL);
-if (empty($returnto)) {
+$returnto = optional_param('returnto', null, PARAM_LOCALURL);
+
+if (!empty($returnto)) {
+    $returnto = new moodle_url($returnto);
+} else {
     $returnto = new moodle_url('/mod/lesson/edit.php', array('id' => $id));
     $returnto->set_anchor('lesson-' . $pageid);
 }
diff --git a/mod/lesson/locallib.php b/mod/lesson/locallib.php
index 7ce6b74bffd..30a8d4b5b62 100644
--- a/mod/lesson/locallib.php
+++ b/mod/lesson/locallib.php
@@ -584,7 +584,7 @@ function lesson_add_header_buttons($cm, $context, $extraeditbuttons=false, $less
                 'id'       => $cm->id,
                 'pageid'   => $lessonpageid,
                 'edit'     => 1,
-                'returnto' => $PAGE->url->out(false)
+                'returnto' => $PAGE->url->out_as_local_url(false)
             ));
             $PAGE->set_button($OUTPUT->single_button($url, get_string('editpagecontent', 'lesson')));
         }
@@ -1363,7 +1363,7 @@ abstract class lesson_add_page_form_base extends moodleform {
 
         if (!empty($this->_customdata['returnto'])) {
             $mform->addElement('hidden', 'returnto', $this->_customdata['returnto']);
-            $mform->setType('returnto', PARAM_URL);
+            $mform->setType('returnto', PARAM_LOCALURL);
         }
 
         $mform->addElement('hidden', 'id');