Details
-
Bug
-
Status: Closed
-
Minor
-
Resolution: Fixed
-
3.7.1, 3.8
-
MOODLE_37_STABLE, MOODLE_38_STABLE
-
MOODLE_37_STABLE, MOODLE_38_STABLE
-
MDL-66237-master -
Description
The mark_notifications_read.php script contains an open redirect (the $redirecturl parameter), which can be manipulated to send users offsite - i.e. with the following URL:
Knowing the ID value for any notification received by a specific user makes this quite difficult to exploit in practice
Seems like the parameter is redundant anyway and the $redirecturl can be obtained directly from the $notification->contexturl field
To reproduce:
- Login as user A
- Send a contact request from user A to user B
- Login as user B
- Open notification drawer
- Hover over the "Contact request" notification
- Update &redirecturl=[URL] parameter
- Click on notification to mark as read
- Note you are redirected offsite to [URL]