moodle/moodle
3
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-08-02 07:39:54 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDL-49179 weblib: Secure the direct usage of $_SERVER['HTTP_REFERER']

Browse source
This commit is contained in:
Frederic Massart 2015-03-04 16:00:32 +01:00 • committed by Mr. Jenkins (CiBoT)
parent dd0607b7bb
commit b2687a055d
9 changed files with 23 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

10
user/view.php
View file

@ -112,8 +112,9 @@ if ($currentuser) {
// Need to have full access to a course to see the rest of own info.
echo $OUTPUT->header();
echo $OUTPUT->heading(get_string('notenrolled', '', $fullname));
if (!empty($_SERVER['HTTP_REFERER'])) {
echo $OUTPUT->continue_button($_SERVER['HTTP_REFERER']);
$referer = clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL);
if (!empty($referer)) {
echo $OUTPUT->continue_button($referer);
}
echo $OUTPUT->footer();
die;
@ -143,8 +144,9 @@ if ($currentuser) {
$PAGE->navbar->add($struser);
echo $OUTPUT->heading(get_string('notenrolledprofile'));
}
if (!empty($_SERVER['HTTP_REFERER'])) {
echo $OUTPUT->continue_button($_SERVER['HTTP_REFERER']);
$referer = clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL);
if (!empty($referer)) {
echo $OUTPUT->continue_button($referer);
}
echo $OUTPUT->footer();
exit;