From 7c97129a9ae2e914b02aeebb4e941fefa8470b39 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20S=CC=8Ckoda?= Date: Thu, 12 Sep 2013 22:30:52 +0200 Subject: [PATCH] MDL-41223 do not store any form of login URL in $SESSION->wantsurl Credit goes to Michael Milette, thanks. --- login/index.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/login/index.php b/login/index.php index e4293dc5ded..001cc9eb8ce 100644 --- a/login/index.php +++ b/login/index.php @@ -274,7 +274,8 @@ if (empty($SESSION->wantsurl)) { $_SERVER["HTTP_REFERER"] != $CFG->wwwroot && $_SERVER["HTTP_REFERER"] != $CFG->wwwroot.'/' && $_SERVER["HTTP_REFERER"] != $CFG->httpswwwroot.'/login/' && - $_SERVER["HTTP_REFERER"] != $CFG->httpswwwroot.'/login/index.php') + strpos($_SERVER["HTTP_REFERER"], $CFG->httpswwwroot.'/login/?') !== 0 && + strpos($_SERVER["HTTP_REFERER"], $CFG->httpswwwroot.'/login/index.php') !== 0) // There might be some extra params such as ?lang=. ? $_SERVER["HTTP_REFERER"] : NULL; }