L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-64651 comments: Do not send referrer

Browse Source 
Use blanktarget option on all comments to prevent malicious links.
This commit is contained in:
Damyon Wiese
2019-03-05 04:17:42 +01:00
committed by Jenkins
parent b77dcd23d8
commit 907b377e51
3 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
comment/classes/external.php
+3 -1
View File
@@ -102,6 +102,7 @@ class core_comment_external extends external_api {
if ($comments === false) {
throw new moodle_exception('nopermissions', 'error', '', 'view comments');
}
$options = array('blanktarget' => true);
foreach ($comments as $key => $comment) {
@@ -110,7 +111,8 @@ class core_comment_external extends external_api {
$context->id,
$params['component'],
'',
0);
0,
$options);
}
$results = array(
comment/lib.php
+3 -2
View File
@@ -570,7 +570,7 @@ class comment {
$params['itemid'] = $this->itemid;
$comments = array();
$formatoptions = array('overflowdiv' => true);
$formatoptions = array('overflowdiv' => true, 'blanktarget' => true);
$rs = $DB->get_recordset_sql($sql, $params, $start, $perpage);
foreach ($rs as $u) {
$c = new stdClass();
@@ -717,7 +717,8 @@ class comment {
$newcmt->fullname = fullname($USER);
$url = new moodle_url('/user/view.php', array('id' => $USER->id, 'course' => $this->courseid));
$newcmt->profileurl = $url->out();
$newcmt->content = format_text($newcmt->content, $newcmt->format, array('overflowdiv'=>true));
$formatoptions = array('overflowdiv' => true, 'blanktarget' => true);
$newcmt->content = format_text($newcmt->content, $newcmt->format, $formatoptions);
$newcmt->avatar = $OUTPUT->user_picture($USER, array('size'=>16));
$commentlist = array($newcmt);
comment/locallib.php
+1 -1
View File
@@ -68,7 +68,7 @@ class comment_manager {
ON u.id=c.userid
ORDER BY c.timecreated ASC";
$rs = $DB->get_recordset_sql($sql, null, $start, $this->perpage);
$formatoptions = array('overflowdiv' => true);
$formatoptions = array('overflowdiv' => true, 'blanktarget' => true);
foreach ($rs as $item) {
// Set calculated fields
$item->fullname = fullname($item);