MDL-72171 tool_mobile: Ensure auto login URL is always local

2022-07-06 14:28:39 +08:00
parent 0f4e8413fc
commit cd6e0bf763
1 changed files with 2 additions and 1 deletions
@@ -27,7 +27,8 @@ require_once($CFG->libdir . '/externallib.php');

 $userid = required_param('userid', PARAM_INT);  // The user id the key belongs to (for double-checking).
 $key = required_param('key', PARAM_ALPHANUMEXT);    // The key generated by the tool_mobile_external::get_autologin_key() external function.
-$urltogo = optional_param('urltogo', $CFG->wwwroot, PARAM_URL);    // URL to redirect.
+$urltogo = optional_param('urltogo', $CFG->wwwroot, PARAM_LOCALURL);    // URL to redirect.
+$urltogo = $urltogo ?: $CFG->wwwroot;

 $context = context_system::instance();
 $PAGE->set_context($context);