MDL-49179 weblib: Secure the direct usage of $_SERVER['HTTP_REFERER']

2015-05-05 18:31:14 +08:00
parent 278cd8f20f
commit 7f426dd24f
9 changed files with 23 additions and 21 deletions
@@ -78,8 +78,9 @@ if ($courseid) {
        }

        // Return to previous page
-        if (!empty($_SERVER['HTTP_REFERER'])) {
-            redirect($_SERVER['HTTP_REFERER']);
+        $referer = clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL);
+        if (!empty($referer)) {
+            redirect($referer);
        } else {
            redirect('view.php?id='.$course->id);
        }