L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-50688 lib: fix local url validation bug

Browse Source 
Change-Id: I350bb8c9ace5cc0403f083f728c100097be7aa7e
Reviewed-on: https://review.totaralms.com/8101
Tested-by: Jenkins Automation <[email protected]>
Reviewed-by: Sam Hemelryk <[email protected]>
Reviewed-by: Alastair Munro <[email protected]>
This commit is contained in:
Petr Skoda
2015-06-29 17:49:38 +02:00
committed by Eloy Lafuente (stronk7)
parent a2f36ceef5
commit 9580c08e9e
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/moodlelib.php
+7 -3
View File
@@ -1036,11 +1036,15 @@ function clean_param($param, $type) {
// Simulate the HTTPS version of the site.
$httpswwwroot = str_replace('http://', 'https://', $CFG->wwwroot);
if (preg_match(':^/:', $param)) {
if ($param === $CFG->wwwroot) {
// Exact match;
} else if (!empty($CFG->loginhttps) && $param === $httpswwwroot) {
// Exact match;
} else if (preg_match(':^/:', $param)) {
// Root-relative, ok!
} else if (preg_match('/^' . preg_quote($CFG->wwwroot, '/') . '/i', $param)) {
} else if (preg_match('/^' . preg_quote($CFG->wwwroot . '/', '/') . '/i', $param)) {
// Absolute, and matches our wwwroot.
} else if (!empty($CFG->loginhttps) && preg_match('/^' . preg_quote($httpswwwroot, '/') . '/i', $param)) {
} else if (!empty($CFG->loginhttps) && preg_match('/^' . preg_quote($httpswwwroot . '/', '/') . '/i', $param)) {
// Absolute, and matches our httpswwwroot.
} else {
// Relative - let's make sure there are no tricks.