MDL-85104 lib: Add additional check to local URLs params.

2025-04-11 10:22:17 +07:00
parent 72d54c6b1e
commit d834f8698f
1 changed files with 3 additions and 2 deletions
@@ -1041,8 +1041,9 @@ enum param: string {
                // Absolute, and matches our wwwroot.
            } else {
                // Relative - let's make sure there are no tricks.
-                if (validateUrlSyntax('/' . $param, 's-u-P-a-p-f+q?r?') && !preg_match('/javascript:/i', $param)) {
-                    // Looks ok.
+                if (validateUrlSyntax('/' . $param, 's-u-P-a-p-f+q?r?') &&
+                        !preg_match('/javascript(?:.*\/{2,})?:/i', rawurldecode($param))) {
+                    // Valid relative local URL.
                } else {
                    $param = '';
                }