MDL-73498 mod_lti: iframe allowed domain fixed

moodle · Jun 20, 2022 · 0957e83 · 0957e83
1 parent 8303206
commit 0957e83
Showing 1 changed file with 6 additions and 4 deletions.
diff --git a/mod/lti/view.php b/mod/lti/view.php
@@ -72,8 +72,10 @@
 }
 if ($typeid) {
     $toolconfig = lti_get_type_config($typeid);
+    $toolurl = $toolconfig['toolurl'];
 } else {
     $toolconfig = array();
+    $toolurl = $lti->toolurl;
 }
 
 $PAGE->set_cm($cm, $course); // Set's up global $COURSE.
@@ -151,11 +153,11 @@
         $content = lti_initiate_login($cm->course, $id, $lti, $config);
     }
 
-    // Build the allowed URL, since we know what it will be from $lti->toolurl,
-    // If the specified toolurl is invalid the iframe won't load, but we still want to avoid parse related errors here.
-    // So we set an empty default allowed url, and only build a real one if the parse is successful.
+    // Build the allowed URL, since we know what it will be from $toolurl.
+    // If the specified URL is invalid, the iframe won't load, but we still want to avoid parse related errors here.
+    // So we set an empty default allowed URL, and only build a real one if the parse is successful.
     $ltiallow = '';
-    $urlparts = parse_url($lti->toolurl);
+    $urlparts = parse_url($toolurl);
     if ($urlparts && array_key_exists('scheme', $urlparts) && array_key_exists('host', $urlparts)) {
         $ltiallow = $urlparts['scheme'] . '://' . $urlparts['host'];
         // If a port has been specified we append that too.