Skip to content

Commit a669ca3

Browse files
committed
Add urlencode to protect origin and cidReq
1 parent dd33807 commit a669ca3

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

main/inc/lib/api.lib.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2198,8 +2198,8 @@ function api_get_cidreq_params($courseCode, $sessionId = 0, $groupId = 0)
21982198
function api_get_cidreq($addSessionId = true, $addGroupId = true, $origin = '')
21992199
{
22002200
$courseCode = api_get_course_id();
2201-
$url = empty($courseCode) ? '' : 'cidReq='.htmlspecialchars($courseCode);
2202-
$origin = empty($origin) ? api_get_origin() : Security::remove_XSS($origin);
2201+
$url = empty($courseCode) ? '' : 'cidReq='.urlencode(htmlspecialchars($courseCode));
2202+
$origin = empty($origin) ? api_get_origin() : urlencode(Security::remove_XSS($origin));
22032203

22042204
if ($addSessionId) {
22052205
if (!empty($url)) {
@@ -8840,7 +8840,7 @@ function convert_double_quote_to_single($in_text)
88408840
*/
88418841
function api_get_origin()
88428842
{
8843-
return isset($_REQUEST['origin']) ? Security::remove_XSS($_REQUEST['origin']) : '';
8843+
return isset($_REQUEST['origin']) ? urlencode(Security::remove_XSS(urlencode($_REQUEST['origin']))) : '';
88448844
}
88458845

88468846
/**

0 commit comments

Comments
 (0)