L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-36988 cleanup role switching

Browse Source 
This patch uses local URLs in parameters because it is more compatible
with various security hacks. Session key is not added automatically to
return url for safety reasons - we do not want to execute some random
action again. POST pages are now returned to course page too.
This commit is contained in:
Petr Škoda
2013-01-15 21:44:20 +01:00
parent ca48fe5f97
commit aae028d9e3
4 changed files with 23 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/navigationlib.php
+1 -3
View File
@@ -3595,10 +3595,8 @@ class settings_navigation extends navigation_node {
if ((count($roles)==1 && array_key_exists(0, $roles))|| $assumedrole!==false) {
$switchroles->force_open();
}
$returnurl = $this->page->url;
$returnurl->param('sesskey', sesskey());
foreach ($roles as $key => $name) {
$url = new moodle_url('/course/switchrole.php', array('id'=>$course->id,'sesskey'=>sesskey(), 'switchrole'=>$key, 'returnurl'=>$returnurl->out(false)));
$url = new moodle_url('/course/switchrole.php', array('id'=>$course->id, 'sesskey'=>sesskey(), 'switchrole'=>$key, 'returnurl'=>$this->page->url->out_as_local_url(false)));
$switchroles->add($name, $url, self::TYPE_SETTING, null, $key, new pix_icon('i/switchrole', ''));
}
}