moodle/moodle
3
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-08-05 00:46:50 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDL-33791 Portfolio: Fixed security issue with passing file paths.

Browse source
This commit is contained in:
Mark Nelson 2012-11-07 16:39:01 +08:00 • committed by Eloy Lafuente (stronk7)
parent 845cfc3389
commit d8e550e4ac
2 changed files with 72 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

11
portfolio/add.php
View file

@ -173,13 +173,10 @@ if (!empty($dataid)) {
$callbackargs[substr($key, 3)] = $value;
}
}
// righto, now we have the callback args set up
// load up the caller file and class and tell it to set up all the data
// it needs
require_once($CFG->dirroot . $callbackfile);
if (!class_exists($callbackclass) || !is_subclass_of($callbackclass, 'portfolio_caller_base')) {
throw new portfolio_caller_exception('callbackclassinvalid', 'portfolio');
}
// Ensure that we found a file we can use, if not throw an exception.
portfolio_include_callback_file($callbackfile, $callbackclass);
$caller = new $callbackclass($callbackargs);
$caller->set('user', $USER);
if ($formats = explode(',', $callerformats)) {