MDL-72029 Lesson: Prevent arbitrary file read when importing lesson questions in blackboard format

2022-05-06 12:21:39 +07:00
parent d585f902fc
commit 3cafb305de
1 changed files with 2 additions and 1 deletions
@@ -152,7 +152,8 @@ class qformat_blackboard_six extends qformat_blackboard_six_base {
                    }
                    if ($examfile->getAttribute('type') == 'assessment/x-bb-pool') {
                        if ($examfile->getAttribute('baseurl')) {
-                            $fileobj->filebase = $this->tempdir. '/' . $examfile->getAttribute('baseurl');
+                            $fileobj->filebase = clean_param($this->tempdir . '/'
+                                . $examfile->getAttribute('baseurl'), PARAM_SAFEPATH);
                        }
                        if ($content = $this->get_filecontent($examfile->getAttribute('file'))) {
                            $fileobj->filetype = self::FILETYPE_POOL;