MDL-85104 lib: Add additional check to local URLs params.

2025-04-11 10:22:58 +07:00
parent ca40241461
commit c2bcdedbd6
1 changed files with 3 additions and 3 deletions
@@ -1105,10 +1105,10 @@ function clean_param($param, $type) {
                } else if (preg_match('/^' . preg_quote($CFG->wwwroot . '/', '/') . '/i', $param)) {
                    // Absolute, and matches our wwwroot.
                } else {
-
                    // Relative - let's make sure there are no tricks.
-                    if (validateUrlSyntax('/' . $param, 's-u-P-a-p-f+q?r?') && !preg_match('/javascript:/i', $param)) {
-                        // Looks ok.
+                    if (validateUrlSyntax('/' . $param, 's-u-P-a-p-f+q?r?') &&
+                            !preg_match('/javascript(?:.*\/{2,})?:/i', rawurldecode($param))) {
+                        // Valid relative local URL.
                    } else {
                        $param = '';
                    }