From e5ece45e84d3124b8fd86983e3bce0e9fa0f33ab Mon Sep 17 00:00:00 2001 From: Ruslan Kabalin Date: Fri, 16 Jun 2017 16:12:09 +0100 Subject: [PATCH] MDL-59273 core: Remove mailto links support in clean_param. --- lib/moodlelib.php | 5 +++-- lib/tests/moodlelib_test.php | 3 +++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/lib/moodlelib.php b/lib/moodlelib.php index 96d13f4048c..0a374d16f4d 100644 --- a/lib/moodlelib.php +++ b/lib/moodlelib.php @@ -1033,10 +1033,11 @@ function clean_param($param, $type) { } return $param; - case PARAM_URL: // Allow safe ftp, http, mailto urls. + case PARAM_URL: + // Allow safe urls. $param = fix_utf8($param); include_once($CFG->dirroot . '/lib/validateurlsyntax.php'); - if (!empty($param) && validateUrlSyntax($param, 's?H?S?F?E?u-P-a?I?p?f?q?r?')) { + if (!empty($param) && validateUrlSyntax($param, 's?H?S?F?E-u-P-a?I?p?f?q?r?')) { // All is ok, param is respected. } else { // Not really ok. diff --git a/lib/tests/moodlelib_test.php b/lib/tests/moodlelib_test.php index 6c66e9a95f7..d3148878d28 100644 --- a/lib/tests/moodlelib_test.php +++ b/lib/tests/moodlelib_test.php @@ -615,6 +615,9 @@ class core_moodlelib_testcase extends advanced_testcase { $this->assertSame('', clean_param('rtmp://example.com/livestream', PARAM_URL)); $this->assertSame('', clean_param('rtmp://example.com/live&foo', PARAM_URL)); $this->assertSame('', clean_param('rtmp://example.com/fms&mp4:path/to/file.mp4', PARAM_URL)); + $this->assertSame('', clean_param('mailto:support@moodle.org', PARAM_URL)); + $this->assertSame('', clean_param('mailto:support@moodle.org?subject=Hello%20Moodle', PARAM_URL)); + $this->assertSame('', clean_param('mailto:support@moodle.org?subject=Hello%20Moodle&cc=feedback@moodle.org', PARAM_URL)); } public function test_clean_param_localurl() {