MDL-66377 user: Only allow active users to retrieve files via tokenpluginfile.php

2019-11-05 13:47:43 +01:00
parent f68e327afa
commit 2e4684f51c
2 changed files with 3 additions and 0 deletions
@@ -37,6 +37,7 @@ if (0 == strpos($relativepath, '/token/')) {
    $relativepath = ltrim($relativepath, '/');
    $pathparts = explode('/', $relativepath, 2);
    $token = $pathparts[0];
+    $token = clean_param($token, PARAM_ALPHANUM);
    $relativepath = "/{$pathparts[1]}";
 }