/**
 * Return full url with all extra parameters
 * @param string $url
 * @param object $cm
 * @param object $course
 * @return string url
 */
function url_get_full_url($url, $cm, $course, $config = null)
{
    $parameters = empty($url->parameters) ? array() : unserialize($url->parameters);
    if (empty($parameters)) {
        // easy - no params
        return $url->externalurl;
    }
    if (!$config) {
        $config = get_config('url');
    }
    $paramvalues = url_get_variable_values($url, $cm, $course, $config);
    foreach ($parameters as $parse => $parameter) {
        if (isset($paramvalues[$parameter])) {
            $parameters[$parse] = urlencode($parse) . '=' . urlencode($paramvalues[$parameter]);
        } else {
            unset($parameters[$parse]);
        }
    }
    if (empty($parameters)) {
        // easy - no params available
        return $url->externalurl;
    }
    if (stripos($url->externalurl, 'teamspeak://') === 0) {
        return $url->externalurl . '?' . implode('?', $parameters);
    } else {
        $join = strpos($url->externalurl, '?') === false ? '?' : '&';
        return $url->externalurl . $join . implode('&', $parameters);
    }
}
Esempio n. 2
0
/**
 * Return full url with all extra parameters
 *
 * This function does not include any XSS protection.
 *
 * @param string $url
 * @param object $cm
 * @param object $course
 * @param object $config
 * @return string url with & encoded as &
 */
function url_get_full_url($url, $cm, $course, $config = null)
{
    $parameters = empty($url->parameters) ? array() : unserialize($url->parameters);
    // make sure there are no encoded entities, it is ok to do this twice
    $fullurl = html_entity_decode($url->externalurl, ENT_QUOTES, 'UTF-8');
    if (preg_match('/^(\\/|https?:|ftp:)/i', $fullurl) or preg_match('|^/|', $fullurl)) {
        // encode extra chars in URLs - this does not make it always valid, but it helps with some UTF-8 problems
        $allowed = "a-zA-Z0-9" . preg_quote(';/?:@=&$_.+!*(),-#%', '/');
        $fullurl = preg_replace_callback("/[^{$allowed}]/", 'url_filter_callback', $fullurl);
    } else {
        // encode special chars only
        $fullurl = str_replace('"', '%22', $fullurl);
        $fullurl = str_replace('\'', '%27', $fullurl);
        $fullurl = str_replace(' ', '%20', $fullurl);
        $fullurl = str_replace('<', '%3C', $fullurl);
        $fullurl = str_replace('>', '%3E', $fullurl);
    }
    // add variable url parameters
    if (!empty($parameters)) {
        if (!$config) {
            $config = get_config('url');
        }
        $paramvalues = url_get_variable_values($url, $cm, $course, $config);
        foreach ($parameters as $parse => $parameter) {
            if (isset($paramvalues[$parameter])) {
                $parameters[$parse] = rawurlencode($parse) . '=' . rawurlencode($paramvalues[$parameter]);
            } else {
                unset($parameters[$parse]);
            }
        }
        if (!empty($parameters)) {
            if (stripos($fullurl, 'teamspeak://') === 0) {
                $fullurl = $fullurl . '?' . implode('?', $parameters);
            } else {
                $join = strpos($fullurl, '?') === false ? '?' : '&';
                $fullurl = $fullurl . $join . implode('&', $parameters);
            }
        }
    }
    // encode all & to &amp; entity
    $fullurl = str_replace('&', '&amp;', $fullurl);
    return $fullurl;
}