Security: Avoid error in catalogue when attempted hack in course code…

… - refs BT#22085
chamilo · Oct 8, 2024 · b440012 · b440012
1 parent d8b42f6
commit b440012
Showing 1 changed file with 15 additions and 6 deletions.
diff --git a/main/auth/courses.php b/main/auth/courses.php
@@ -67,14 +67,23 @@
         }
         if (Security::check_token('get')) {
             $courseInfo = api_get_course_info($courseCodeToSubscribe);
-            CourseManager::autoSubscribeToCourse($courseCodeToSubscribe);
-            $redirectionTarget = CoursesAndSessionsCatalog::generateRedirectUrlAfterSubscription(
-                $courseInfo['course_public_url']
-            );
+            if (!empty($courseInfo)) {
+                CourseManager::autoSubscribeToCourse($courseCodeToSubscribe);
+                $redirectionTarget = CoursesAndSessionsCatalog::generateRedirectUrlAfterSubscription(
+                    $courseInfo['course_public_url']
+                );
 
-            header("Location: $redirectionTarget");
-            exit;
+                header("Location: $redirectionTarget");
+                exit;
+            }
         }
+        Display::addFlash(
+            Display::return_message(get_lang('NoResults'), 'warning')
+        );
+        CoursesAndSessionsCatalog::displayCoursesList('search_course', $searchTerm, $categoryCode);
+
+        exit;
+
         break;
     case 'subscribe_course_validation':
         $toolTitle = get_lang('Subscribe');