From 980bd08bdc01586bf8b5d407b049645ea6ff1174 Mon Sep 17 00:00:00 2001 From: Petr Skoda Date: Mon, 15 Jun 2015 10:20:12 +1200 Subject: [PATCH] MDL-50688 lib: fix local url validation bug Change-Id: I350bb8c9ace5cc0403f083f728c100097be7aa7e Reviewed-on: https://review.totaralms.com/8101 Tested-by: Jenkins Automation Reviewed-by: Sam Hemelryk Reviewed-by: Alastair Munro --- lib/moodlelib.php | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/lib/moodlelib.php b/lib/moodlelib.php index 402f19a50d4..05e80fe8b78 100644 --- a/lib/moodlelib.php +++ b/lib/moodlelib.php @@ -1036,11 +1036,15 @@ function clean_param($param, $type) { // Simulate the HTTPS version of the site. $httpswwwroot = str_replace('http://', 'https://', $CFG->wwwroot); - if (preg_match(':^/:', $param)) { + if ($param === $CFG->wwwroot) { + // Exact match; + } else if (!empty($CFG->loginhttps) && $param === $httpswwwroot) { + // Exact match; + } else if (preg_match(':^/:', $param)) { // Root-relative, ok! - } else if (preg_match('/^' . preg_quote($CFG->wwwroot, '/') . '/i', $param)) { + } else if (preg_match('/^' . preg_quote($CFG->wwwroot . '/', '/') . '/i', $param)) { // Absolute, and matches our wwwroot. - } else if (!empty($CFG->loginhttps) && preg_match('/^' . preg_quote($httpswwwroot, '/') . '/i', $param)) { + } else if (!empty($CFG->loginhttps) && preg_match('/^' . preg_quote($httpswwwroot . '/', '/') . '/i', $param)) { // Absolute, and matches our httpswwwroot. } else { // Relative - let's make sure there are no tricks.