From 30ca2558dc0beb42c59b77a346cffadcbf213d46 Mon Sep 17 00:00:00 2001
From: Adam Olley <adam.olley@blackboard.com>
Date: Mon, 30 Apr 2018 12:57:24 +0930
Subject: [PATCH] MDL-62232 mod_forum: Limit portfolio to files belonging to
 the post

---
 mod/forum/locallib.php | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/mod/forum/locallib.php b/mod/forum/locallib.php
index b446d27339c..6f57004d28c 100644
--- a/mod/forum/locallib.php
+++ b/mod/forum/locallib.php
@@ -95,6 +95,12 @@ class forum_portfolio_caller extends portfolio_module_caller_base {
         $fs = get_file_storage();
         if ($this->post) {
             if ($this->attachment) {
+                // Make sure the requested file belongs to this post.
+                $file = $fs->get_file_by_id($this->attachment);
+                if ($file->get_contextid() != $this->modcontext->id
+                    || $file->get_itemid() != $this->post->id) {
+                    throw new portfolio_caller_exception('filenotfound');
+                }
                 $this->set_file_and_format_data($this->attachment);
             } else {
                 $attach = $fs->get_area_files($this->modcontext->id, 'mod_forum', 'attachment', $this->post->id, 'timemodified', false);