MDL-85104 lib: Add additional check to local URLs params.

2025-04-11 10:21:40 +07:00
parent 5e3047aa40
commit ff9bbd6d9e
1 changed files with 3 additions and 2 deletions
@@ -1067,8 +1067,9 @@ enum param: string {
                // Absolute, and matches our wwwroot.
            } else {
                // Relative - let's make sure there are no tricks.
-                if (validateUrlSyntax('/' . $param, 's-u-P-a-p-f+q?r?') && !preg_match('/javascript:/i', $param)) {
-                    // Looks ok.
+                if (validateUrlSyntax('/' . $param, 's-u-P-a-p-f+q?r?') &&
+                        !preg_match('/javascript(?:.*\/{2,})?:/i', rawurldecode($param))) {
+                    // Valid relative local URL.
                } else {
                    $param = '';
                }