MDL-30042: Sanitize httpwwwroot in mnet jump

2011-11-10 10:18:03 +00:00
parent 919e659ba6
commit f6d6e5446d
1 changed files with 7 additions and 0 deletions
@@ -37,6 +37,13 @@ if (!is_enabled_auth('mnet')) {

 // If hostid hasn't been specified, try getting it using wwwroot
 if (!$hostid) {
+    $hostwwwroot = trim($hostwwwroot);
+    $hostwwwroot = rtrim($hostwwwroot, '/');
+
+    // ensure the wwwroot starts with a http or https prefix
+    if (strtolower(substr($hostwwwroot, 0, 4)) != 'http') {
+        $hostwwwroot = 'http://'.$hostwwwroot;
+    }
    $hostid = $DB->get_field('mnet_host', 'id', array('wwwroot' => $hostwwwroot));
 }