From c5fcbd10818a06ff3be5e1b4f7ea25f58d3a5dd1 Mon Sep 17 00:00:00 2001 From: Mark Nelson Date: Wed, 11 Jul 2018 13:29:18 +0800 Subject: [PATCH] MDL-62889 message_popup: redirect to notification page if url is empty If you pass a URL that is not a valid URL (for example ';') it is cleaned to an empty string which redirects to $CFG->wwwroot/message/output/popup/ which is not a valid page. --- message/output/popup/mark_notification_read.php | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/message/output/popup/mark_notification_read.php b/message/output/popup/mark_notification_read.php index ad92b376c17..f2dd6096aa5 100644 --- a/message/output/popup/mark_notification_read.php +++ b/message/output/popup/mark_notification_read.php @@ -31,9 +31,14 @@ if (isguestuser()) { } $notificationid = required_param('notificationid', PARAM_INT); -$redirecturl = optional_param('redirecturl', $CFG->wwwroot, PARAM_URL); +$redirecturl = optional_param('redirecturl', '', PARAM_URL); $notification = $DB->get_record('notifications', array('id' => $notificationid)); +// If the redirect URL after filtering is empty, or it was never passed, then redirect to the notification page. +if (empty($redirecturl)) { + $redirecturl = new moodle_url('/message/output/popup/notifications.php', ['notificationid' => $notificationid]); +} + // Check notification belongs to this user. if ($USER->id != $notification->useridto) { redirect($CFG->wwwroot);