L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-59273 core: Remove mailto links support in clean_param.

Browse Source
This commit is contained in:
Ruslan Kabalin
2017-07-24 16:51:55 +01:00
parent 229ae617c5
commit e5ece45e84
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/moodlelib.php
+3 -2
View File
@@ -1033,10 +1033,11 @@ function clean_param($param, $type) {
}
return $param;
case PARAM_URL: // Allow safe ftp, http, mailto urls.
case PARAM_URL:
// Allow safe urls.
$param = fix_utf8($param);
include_once($CFG->dirroot . '/lib/validateurlsyntax.php');
if (!empty($param) && validateUrlSyntax($param, 's?H?S?F?E?u-P-a?I?p?f?q?r?')) {
if (!empty($param) && validateUrlSyntax($param, 's?H?S?F?E-u-P-a?I?p?f?q?r?')) {
// All is ok, param is respected.
} else {
// Not really ok.
lib/tests/moodlelib_test.php
+3
View File
@@ -615,6 +615,9 @@ class core_moodlelib_testcase extends advanced_testcase {
$this->assertSame('', clean_param('rtmp://example.com/livestream', PARAM_URL));
$this->assertSame('', clean_param('rtmp://example.com/live&foo', PARAM_URL));
$this->assertSame('', clean_param('rtmp://example.com/fms&mp4:path/to/file.mp4', PARAM_URL));
$this->assertSame('', clean_param('mailto:[email protected]', PARAM_URL));
$this->assertSame('', clean_param('mailto:[email protected]?subject=Hello%20Moodle', PARAM_URL));
$this->assertSame('', clean_param('mailto:[email protected]?subject=Hello%20Moodle&[email protected]', PARAM_URL));
}
public function test_clean_param_localurl() {