MDL-73402 block_admin_bookmarks: slightly relax section cleaning.

Allow '/' character in external page names.
This commit is contained in:
Paul Holden
2021-12-17 11:59:21 +00:00
parent 696857a008
commit a8a8555b4f
3 changed files with 6 additions and 5 deletions
+2 -1
View File
@@ -30,7 +30,8 @@ $context = context_system::instance();
$PAGE->set_context($context);
$adminroot = admin_get_root(false, false); // settings not required - only pages
if ($section = optional_param('section', '', PARAM_SAFEDIR) and confirm_sesskey()) {
// We clean section with safe path here for compatibility with external pages that include a slash in their name.
if ($section = optional_param('section', '', PARAM_SAFEPATH) and confirm_sesskey()) {
if (get_user_preferences('admin_bookmarks')) {
$bookmarks = explode(',', get_user_preferences('admin_bookmarks'));