L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-49179 mod_forum, mod_quiz: Prevent misuse of get_referer()

Browse Source
This commit is contained in:
Frederic Massart
2015-05-05 18:31:13 +08:00
committed by Mr. Jenkins (CiBoT)
parent e51fdfe0cb
commit dd0607b7bb
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod/forum/post.php
+2 -1
View File
@@ -87,9 +87,10 @@ if (!isloggedin() or isguestuser()) {
$PAGE->set_context($modcontext);
$PAGE->set_title($course->shortname);
$PAGE->set_heading($course->fullname);
$referer = clean_param(get_referer(false), PARAM_LOCALURL);
echo $OUTPUT->header();
echo $OUTPUT->confirm(get_string('noguestpost', 'forum').'<br /><br />'.get_string('liketologin'), get_login_url(), get_referer(false));
echo $OUTPUT->confirm(get_string('noguestpost', 'forum').'<br /><br />'.get_string('liketologin'), get_login_url(), $referer);
echo $OUTPUT->footer();
exit;
}
mod/quiz/renderer.php
+2 -2
View File
@@ -850,8 +850,8 @@ class mod_quiz_renderer extends plugin_renderer_base {
$output .= $this->view_information($quiz, $cm, $context, $messages);
$guestno = html_writer::tag('p', get_string('guestsno', 'quiz'));
$liketologin = html_writer::tag('p', get_string('liketologin'));
$output .= $this->confirm($guestno."\n\n".$liketologin."\n", get_login_url(),
get_referer(false));
$referer = clean_param(get_referer(false), PARAM_LOCALURL);
$output .= $this->confirm($guestno."\n\n".$liketologin."\n", get_login_url(), $referer);
return $output;
}