From 420a2002559643da8727fb67b51a696544678cd0 Mon Sep 17 00:00:00 2001
From: Ewa Soroka <ewa.soroka@enovation.ie>
Date: Fri, 14 Aug 2026 10:37:07 +0200
Subject: [PATCH] Fix open redirect in Basic authentication

---
 auth.php | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/auth.php b/auth.php
index 84fd15b..5c0b1c7 100644
--- a/auth.php
+++ b/auth.php
@@ -82,6 +82,8 @@ public function loginpage_hook() {
 
         global $CFG, $DB, $USER, $SESSION;
 
+        $wantsurl = optional_param('wantsurl', '', PARAM_LOCALURL);
+
         $this->log(__FUNCTION__);
 
         if ( isset($_SERVER['PHP_AUTH_USER']) &&
@@ -118,8 +120,8 @@ public function loginpage_hook() {
 
                         if (isset($SESSION->wantsurl) && !empty($SESSION->wantsurl)) {
                             $urltogo = $SESSION->wantsurl;
-                        } else if (isset($_GET['wantsurl'])) {
-                            $urltogo = $_GET['wantsurl'];
+                        } else if ($wantsurl !== '') {
+                            $urltogo = $wantsurl;
                         } else {
                             $urltogo = $CFG->wwwroot;
                         }