diff --git a/lib/classes/param.php b/lib/classes/param.php
index 9c817ff4f5b..341720934c5 100644
--- a/lib/classes/param.php
+++ b/lib/classes/param.php
@@ -1041,8 +1041,9 @@ enum param: string {
                 // Absolute, and matches our wwwroot.
             } else {
                 // Relative - let's make sure there are no tricks.
-                if (validateUrlSyntax('/' . $param, 's-u-P-a-p-f+q?r?') && !preg_match('/javascript:/i', $param)) {
-                    // Looks ok.
+                if (validateUrlSyntax('/' . $param, 's-u-P-a-p-f+q?r?') &&
+                        !preg_match('/javascript(?:.*\/{2,})?:/i', rawurldecode($param))) {
+                    // Valid relative local URL.
                 } else {
                     $param = '';
                 }