From c05645ee901e8a2d0690f4b029967ed1f50a5ce7 Mon Sep 17 00:00:00 2001 From: Thibeau Fuhrer Date: Thu, 20 Aug 2026 14:35:58 +0200 Subject: [PATCH] [FIX] UICore: encode cmd- and base-class parameters This works around the fact the Init component strips some characters from the request URL for security reasons. It uses `rawurlencode()` and `rawurldecode()` in appropriate locations to avoid `\` of namespaced classes. --- components/ILIAS/UICore/classes/class.ilCtrl.php | 4 ++-- components/ILIAS/UICore/classes/class.ilCtrlContext.php | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/components/ILIAS/UICore/classes/class.ilCtrl.php b/components/ILIAS/UICore/classes/class.ilCtrl.php index 711a3a7d88dc..028608307ed4 100755 --- a/components/ILIAS/UICore/classes/class.ilCtrl.php +++ b/components/ILIAS/UICore/classes/class.ilCtrl.php @@ -868,7 +868,7 @@ private function getTargetUrl( $target_url = $this->appendParameterString( $target_url, self::PARAM_BASE_CLASS, - urlencode($base_class), // encode in case of namespaced classes + rawurlencode($base_class), // encode in case of namespaced classes $is_escaped ); @@ -889,7 +889,7 @@ private function getTargetUrl( $target_url = $this->appendParameterString( $target_url, self::PARAM_CMD_CLASS, - urlencode($cmd_class), // encode in case of namespaced classes + rawurlencode($cmd_class), // encode in case of namespaced classes $is_escaped ); } diff --git a/components/ILIAS/UICore/classes/class.ilCtrlContext.php b/components/ILIAS/UICore/classes/class.ilCtrlContext.php index b620ab712402..b9f17903e5f1 100755 --- a/components/ILIAS/UICore/classes/class.ilCtrlContext.php +++ b/components/ILIAS/UICore/classes/class.ilCtrlContext.php @@ -305,14 +305,14 @@ protected function adoptRequestParameters(): void // previously set existing path. $base_class = $this->getQueryParam(ilCtrlInterface::PARAM_BASE_CLASS); if (null !== $base_class) { - $this->setBaseClass($base_class); + $this->setBaseClass(rawurldecode($base_class)); } // set or append the provided command class, which might // override the previously set path again. $cmd_class = $this->getQueryParam(ilCtrlInterface::PARAM_CMD_CLASS); if (null !== $cmd_class) { - $this->setCmdClass($cmd_class); + $this->setCmdClass(rawurldecode($cmd_class)); } }