Merge branch 'MDL-78442-main' of https://github.com/andimendunia/moodle

public/admin/tool/moodlenet/classes/local/import_backup_helper.php

@@ -86,7 +86,7 @@ class import_backup_helper {
         }
 
         [$filepath, $filename] = $this->remoteresource->download_to_requestdir();
-        \core\antivirus\manager::scan_file($filepath, $filename, true);
+        \core\antivirus\manager::scan_file($filepath . DIRECTORY_SEPARATOR . $filename, $filename, true);
 
         // Check the final size of file against the user upload limits.
         $localsize = filesize(sprintf('%s/%s', $filepath, $filename));

public/admin/tool/moodlenet/classes/local/import_strategy_file.php

@@ -78,7 +78,7 @@ class import_strategy_file implements import_strategy {
 
         // Download the file into a request directory and scan it.
         [$filepath, $filename] = $resource->download_to_requestdir();
-        avmanager::scan_file($filepath, $filename, true);
+        avmanager::scan_file($filepath . DIRECTORY_SEPARATOR . $filename, $filename, true);
 
         // Check the final size of file against the user upload limits.
         $localsize = filesize(sprintf('%s/%s', $filepath, $filename));

public/lib/antivirus/clamav/classes/scanner.php

@@ -265,6 +265,9 @@ class scanner extends \core\antivirus\scanner {
             $this->set_scanning_notice($notice);
             return self::SCAN_RESULT_ERROR;
         } else {
+            // For Unix sockets, try SCAN first (fast), then fall back to INSTREAM if it fails.
+            $instreamfallback = false;
+
             if ($type == "unixsocket") {
                 // Execute scanning. We are running SCAN command and passing file as an argument,
                 // it is the fastest option, but clamav user need to be able to access it, so
@@ -282,9 +285,34 @@ class scanner extends \core\antivirus\scanner {
 
                 // After scanning we revert permissions to initial ones.
                 chmod($file, $perms);
-            } else if ($type == "tcpsocket") {
-                // Execute scanning by passing the entire file through the TCP socket.
-                // This is not fast, but is the only possibility over a network.
+
+                // Check if SCAN failed due to permission/path issues.
+                if (
+                    strpos($output, 'File path check failure') !== false ||
+                    strpos($output, 'Permission denied') !== false
+                ) {
+                    debugging('SCAN method failed, trying INSTREAM', DEBUG_DEVELOPER);
+                    $instreamfallback = true;
+                    fclose($socket);
+                    // Reopen socket for INSTREAM attempt.
+                    $socket = stream_socket_client(
+                        $socketurl,
+                        $errno,
+                        $errstr,
+                        ANTIVIRUS_CLAMAV_SOCKET_TIMEOUT
+                    );
+                    if (!$socket) {
+                        $notice = get_string('errorcantopensocket', 'antivirus_clamav', "$errstr ($errno)");
+                        $this->set_scanning_notice($notice);
+                        return self::SCAN_RESULT_ERROR;
+                    }
+                }
+            }
+
+            if ($instreamfallback || $type == "tcpsocket") {
+                // Execute scanning by passing the entire file through the socket.
+                // This is not fast, but is the only possibility over a network and is used
+                // as fallback when SCAN fails.
                 // Using 'n' as command prefix is forcing clamav to only treat \n as newline delimeter,
                 // this is to avoid unexpected newline characters on different systems.