From 38d309036cdd0b642ba5cfa944a68d7f50b2ff0d Mon Sep 17 00:00:00 2001 From: Mark Nelson Date: Wed, 11 Jul 2018 12:54:46 +0800 Subject: [PATCH 1/4] MDL-62889 message_popup: only add redirecturl if it exists We allow notifications to have a null value for the 'contexturl'. In this case we should not be appending a 'redirecturl' param to the URL when it is going to be empty. --- .../amd/build/notification_popover_controller.min.js | 2 +- .../popup/amd/src/notification_popover_controller.js | 11 +++++++---- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/message/output/popup/amd/build/notification_popover_controller.min.js b/message/output/popup/amd/build/notification_popover_controller.min.js index b241a56f097..2222a856e60 100644 --- a/message/output/popup/amd/build/notification_popover_controller.min.js +++ b/message/output/popup/amd/build/notification_popover_controller.min.js @@ -1 +1 @@ -define(["jquery","core/ajax","core/templates","core/str","core/url","core/notification","core/custom_interaction_events","core/popover_region_controller","message_popup/notification_repository","message_popup/notification_area_events"],function(a,b,c,d,e,f,g,h,i,j){var k={MARK_ALL_READ_BUTTON:'[data-action="mark-all-read"]',ALL_NOTIFICATIONS_CONTAINER:'[data-region="all-notifications"]',NOTIFICATION:'[data-region="notification-content-item-container"]',UNREAD_NOTIFICATION:'[data-region="notification-content-item-container"].unread',NOTIFICATION_LINK:'[data-action="content-item-link"]',EMPTY_MESSAGE:'[data-region="empty-message"]',COUNT_CONTAINER:'[data-region="count-container"]'},l=function(a){h.call(this,a),this.markAllReadButton=this.root.find(k.MARK_ALL_READ_BUTTON),this.unreadCount=0,this.userId=this.root.attr("data-userid"),this.container=this.root.find(k.ALL_NOTIFICATIONS_CONTAINER),this.limit=20,this.offset=0,this.loadedAll=!1,this.initialLoad=!1,this.unreadCount=this.root.find(k.COUNT_CONTAINER).html()};return l.prototype=Object.create(h.prototype),l.prototype.constructor=l,l.prototype.updateButtonAriaLabel=function(){this.isMenuOpen()?d.get_string("hidenotificationwindow","message").done(function(a){this.menuToggle.attr("aria-label",a)}.bind(this)):this.unreadCount?d.get_string("shownotificationwindowwithcount","message",this.unreadCount).done(function(a){this.menuToggle.attr("aria-label",a)}.bind(this)):d.get_string("shownotificationwindownonew","message").done(function(a){this.menuToggle.attr("aria-label",a)}.bind(this))},l.prototype.getContent=function(){return this.container},l.prototype.getOffset=function(){return this.offset},l.prototype.incrementOffset=function(){this.offset+=this.limit},l.prototype.hasDoneInitialLoad=function(){return this.initialLoad},l.prototype.hasLoadedAllContent=function(){return this.loadedAll},l.prototype.setLoadedAllContent=function(a){this.loadedAll=a},l.prototype.renderUnreadCount=function(){var a=this.root.find(k.COUNT_CONTAINER);this.unreadCount?(a.text(this.unreadCount),a.removeClass("hidden")):a.addClass("hidden")},l.prototype.hideUnreadCount=function(){this.root.find(k.COUNT_CONTAINER).addClass("hidden")},l.prototype.getNotificationElement=function(a){var b=this.root.find(k.NOTIFICATION+'[data-id="'+a+'"]');return 1==b.length?b:null},l.prototype.renderNotifications=function(b,d){var f=[];return a.each(b,function(a,b){var d=this.getOffset()-this.limit;b.viewmoreurl=e.relativeUrl("/message/output/popup/notifications.php",{notificationid:b.id,offset:d}),b.contexturl=e.relativeUrl("message/output/popup/mark_notification_read.php",{notificationid:b.id,redirecturl:b.contexturl});var g=c.render("message_popup/notification_content_item",b).then(function(a,b){return{html:a,js:b}});f.push(g)}.bind(this)),a.when.apply(a,f).then(function(){a.each(arguments,function(a,b){d.append(b.html),c.runTemplateJS(b.js)})})},l.prototype.loadMoreNotifications=function(){if(this.isLoading||this.hasLoadedAllContent())return a.Deferred().resolve();this.startLoading();var b={limit:this.limit,offset:this.getOffset(),useridto:this.userId},c=this.getContent();return i.query(b).then(function(a){var b=a.notifications;return this.unreadCount=a.unreadcount,this.setLoadedAllContent(!b.length||b.length Date: Fri, 13 Jul 2018 10:45:02 +0800 Subject: [PATCH 2/4] MDL-62889 message_popup: allow redirects to external URLs Many institutions create notifications that link to an external service. We need to allow redirects to these systems. --- message/output/popup/mark_notification_read.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/message/output/popup/mark_notification_read.php b/message/output/popup/mark_notification_read.php index 0d393f4b6f1..ad92b376c17 100644 --- a/message/output/popup/mark_notification_read.php +++ b/message/output/popup/mark_notification_read.php @@ -31,7 +31,7 @@ if (isguestuser()) { } $notificationid = required_param('notificationid', PARAM_INT); -$redirecturl = optional_param('redirecturl', $CFG->wwwroot, PARAM_LOCALURL); +$redirecturl = optional_param('redirecturl', $CFG->wwwroot, PARAM_URL); $notification = $DB->get_record('notifications', array('id' => $notificationid)); // Check notification belongs to this user. From 6dc3988fa070ff5f68997d48590e840b799fca26 Mon Sep 17 00:00:00 2001 From: Mark Nelson Date: Wed, 11 Jul 2018 13:29:18 +0800 Subject: [PATCH 3/4] MDL-62889 message_popup: redirect to notification page if url is empty If you pass a URL that is not a valid URL (for example ';') it is cleaned to an empty string which redirects to $CFG->wwwroot/message/output/popup/ which is not a valid page. --- message/output/popup/mark_notification_read.php | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/message/output/popup/mark_notification_read.php b/message/output/popup/mark_notification_read.php index ad92b376c17..f2dd6096aa5 100644 --- a/message/output/popup/mark_notification_read.php +++ b/message/output/popup/mark_notification_read.php @@ -31,9 +31,14 @@ if (isguestuser()) { } $notificationid = required_param('notificationid', PARAM_INT); -$redirecturl = optional_param('redirecturl', $CFG->wwwroot, PARAM_URL); +$redirecturl = optional_param('redirecturl', '', PARAM_URL); $notification = $DB->get_record('notifications', array('id' => $notificationid)); +// If the redirect URL after filtering is empty, or it was never passed, then redirect to the notification page. +if (empty($redirecturl)) { + $redirecturl = new moodle_url('/message/output/popup/notifications.php', ['notificationid' => $notificationid]); +} + // Check notification belongs to this user. if ($USER->id != $notification->useridto) { redirect($CFG->wwwroot); From c74949b0718ad417d57d59329e62ef9b94d27e08 Mon Sep 17 00:00:00 2001 From: Mark Nelson Date: Wed, 11 Jul 2018 13:26:11 +0800 Subject: [PATCH 4/4] MDL-62889 message_popup: redirect using moodle_url Without this relative URLs passed (like /message/index.php) were being redirected to HOST/message/index.php rather than $CFG->wwwroot/message/index.php. --- message/output/popup/mark_notification_read.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/message/output/popup/mark_notification_read.php b/message/output/popup/mark_notification_read.php index f2dd6096aa5..04586781b26 100644 --- a/message/output/popup/mark_notification_read.php +++ b/message/output/popup/mark_notification_read.php @@ -45,4 +45,4 @@ if ($USER->id != $notification->useridto) { } \core_message\api::mark_notification_as_read($notification); -redirect($redirecturl); +redirect(new moodle_url($redirecturl));