From 0b4100c13e835c5fffe2625a0bbee46635eb20ed Mon Sep 17 00:00:00 2001
From: Paul Holden <paulh@moodle.com>
Date: Thu, 4 Jul 2024 22:46:43 +0100
Subject: [PATCH] MDL-82392 blocks: consistent cleaning of block instance
 names.

---
 backup/moodle2/backup_block_task.class.php | 2 +-
 lib/blocklib.php                           | 3 ++-
 lib/classes/context/block.php              | 9 +++------
 lib/classes/plugininfo/block.php           | 8 +++-----
 4 files changed, 9 insertions(+), 13 deletions(-)

diff --git a/backup/moodle2/backup_block_task.class.php b/backup/moodle2/backup_block_task.class.php
index 3a1fcdd9448..86506b6fe11 100644
--- a/backup/moodle2/backup_block_task.class.php
+++ b/backup/moodle2/backup_block_task.class.php
@@ -52,7 +52,7 @@ abstract class backup_block_task extends backup_task {
         }
 
         $this->blockid    = $blockid;
-        $this->blockname  = $block->blockname;
+        $this->blockname  = clean_param($block->blockname, PARAM_PLUGIN);
         $this->contextid  = context_block::instance($this->blockid)->id;
         $this->moduleid   = $moduleid;
         $this->modulename = null;
diff --git a/lib/blocklib.php b/lib/blocklib.php
index 3ccb07a0734..a0fa392273c 100644
--- a/lib/blocklib.php
+++ b/lib/blocklib.php
@@ -2156,7 +2156,8 @@ function block_instance($blockname, $instance = NULL, $page = NULL) {
 function block_load_class($blockname) {
     global $CFG;
 
-    if(empty($blockname)) {
+    $blocknameclean = clean_param($blockname, PARAM_PLUGIN);
+    if (empty($blockname) || empty($blocknameclean)) {
         return false;
     }
 
diff --git a/lib/classes/context/block.php b/lib/classes/context/block.php
index 0446abd5464..ddf9b167d6b 100644
--- a/lib/classes/context/block.php
+++ b/lib/classes/context/block.php
@@ -75,15 +75,12 @@ class block extends context {
      * @return string the human readable context name.
      */
     public function get_context_name($withprefix = true, $short = false, $escape = true) {
-        global $DB, $CFG;
+        global $DB;
 
         $name = '';
         if ($blockinstance = $DB->get_record('block_instances', array('id' => $this->_instanceid))) {
-            global $CFG;
-            require_once("$CFG->dirroot/blocks/moodleblock.class.php");
-            require_once("$CFG->dirroot/blocks/$blockinstance->blockname/block_$blockinstance->blockname.php");
-            $blockname = "block_$blockinstance->blockname";
-            if ($blockobject = new $blockname()) {
+            $blockobject = block_instance($blockinstance->blockname);
+            if ($blockobject) {
                 if ($withprefix) {
                     $name = get_string('block').': ';
                 }
diff --git a/lib/classes/plugininfo/block.php b/lib/classes/plugininfo/block.php
index e1134882dca..7300eebb830 100644
--- a/lib/classes/plugininfo/block.php
+++ b/lib/classes/plugininfo/block.php
@@ -176,11 +176,9 @@ class block extends base {
 
         if ($block = $DB->get_record('block', array('name'=>$this->name))) {
             // Inform block it's about to be deleted.
-            if (file_exists("$CFG->dirroot/blocks/$block->name/block_$block->name.php")) {
-                $blockobject = block_instance($block->name);
-                if ($blockobject) {
-                    $blockobject->before_delete();  // Only if we can create instance, block might have been already removed.
-                }
+            $blockobject = block_instance($block->name);
+            if ($blockobject) {
+                $blockobject->before_delete();  // Only if we can create instance, block might have been already removed.
             }
 
             // First delete instances and related contexts.