From 7dde0b11871c3bf37986690b33991dfb63e7d852 Mon Sep 17 00:00:00 2001
From: Peter Mayer <admin@pemasoft.de>
Date: Sat, 17 Oct 2026 14:43:43 +0200
Subject: [PATCH] MBS-11517: Restrict returnpath of adhocdebug.php to local
 URLs

---
 adhocdebug.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/adhocdebug.php b/adhocdebug.php
index 26d8dbd..bbc9de1 100644
--- a/adhocdebug.php
+++ b/adhocdebug.php
@@ -35,8 +35,8 @@
 $context = \context_system::instance();
 require_capability('tool/userdebug:adhocdebug', $context, $realuser);
 
-$returnpath = optional_param('returnpath', '/', PARAM_URL);
-$returnurl  = new \moodle_url($returnpath);
+$returnpath = optional_param('returnpath', '/', PARAM_LOCALURL);
+$returnurl  = new \moodle_url($returnpath ?: '/');
 
 $myurl = new \moodle_url($FULLME);
 $myurl->remove_all_params();