After a successful Basic authentication, the plugin reads the wantsurl parameter directly from $_GET and passes it to redirect() without validating that it is a local URL.
Location:
File: auth/basic/auth.php
Current code:
...
} else if (isset($_GET['wantsurl'])) {
$urltogo = $_GET['wantsurl'];
}
...
redirect($urltogo);
This allows an attacker to craft a login URL such as:
https://moodle.example.com/login/index.php?wantsurl=https://evil.example
After successful authentication, the user is redirected to the attacker-controlled website.
Expected behaviour:
The redirect target should be validated and restricted to local Moodle URLs.
RECOMMENDED FIX:
$rawurl = optional_param('wantsurl', '', PARAM_LOCALURL);
if ($rawurl !== '') {
$urltogo = $rawurl; // PARAM_LOCALURL strips external hosts
}
This prevents open redirect attacks while preserving the intended functionality.
After a successful Basic authentication, the plugin reads the wantsurl parameter directly from $_GET and passes it to redirect() without validating that it is a local URL.
Location:
File: auth/basic/auth.php
Current code:
...
} else if (isset($_GET['wantsurl'])) {
$urltogo = $_GET['wantsurl'];
}
...
redirect($urltogo);
This allows an attacker to craft a login URL such as:
https://moodle.example.com/login/index.php?wantsurl=https://evil.example
After successful authentication, the user is redirected to the attacker-controlled website.
Expected behaviour:
The redirect target should be validated and restricted to local Moodle URLs.
RECOMMENDED FIX:
$rawurl = optional_param('wantsurl', '', PARAM_LOCALURL);
if ($rawurl !== '') {
$urltogo = $rawurl; // PARAM_LOCALURL strips external hosts
}
This prevents open redirect attacks while preserving the intended functionality.