Reading query parameters from the referer URL with no cleaning

[james-pearce-bath-ac]

We have recently requested for this plugin to be installed onto our Moodle site. Our hosts have performed a security review of the code and have flagged a potential issue with the view.php file on line #74 as follows -

===================================
Reading query parameters from the referer URL with no cleaning. The usage of the variable in question appears to be safe, but a call to clean_param() is certainly advisable here.

Can the $results['id'] variable have some additional checks and run the clean_param() method on it.

[zeroAps]

Thanks @james-pearce-bath-ac for reporting this issue. I've created internal item in order to fix this for the next release.