From 462785cb7454b1db1c331ea92f88148a6f994c09 Mon Sep 17 00:00:00 2001
From: Sara Arjona <sara@moodle.com>
Date: Thu, 16 Nov 2017 13:26:43 +0100
Subject: [PATCH] MDL-46768 core_badges: changed badge name type from FILE to
 TEXT

---
 badges/edit_form.php | 4 ++--
 badges/mybadges.php  | 1 +
 lib/badgeslib.php    | 1 +
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/badges/edit_form.php b/badges/edit_form.php
index cebc4830461..1c2a40aed31 100644
--- a/badges/edit_form.php
+++ b/badges/edit_form.php
@@ -48,8 +48,8 @@ class edit_details_form extends moodleform {
 
         $mform->addElement('header', 'badgedetails', get_string('badgedetails', 'badges'));
         $mform->addElement('text', 'name', get_string('name'), array('size' => '70'));
-        // Using PARAM_FILE to avoid problems later when downloading badge files.
-        $mform->setType('name', PARAM_FILE);
+        // When downloading badge, it will be necessary to clean the name as PARAM_FILE.
+        $mform->setType('name', PARAM_TEXT);
         $mform->addRule('name', null, 'required');
         $mform->addRule('name', get_string('maximumchars', '', 255), 'maxlength', 255, 'client');
 
diff --git a/badges/mybadges.php b/badges/mybadges.php
index 8437ad46e6a..97c4aeee0bf 100644
--- a/badges/mybadges.php
+++ b/badges/mybadges.php
@@ -72,6 +72,7 @@ if ($hide) {
     require_sesskey();
     $badge = new badge($download);
     $name = str_replace(' ', '_', $badge->name) . '.png';
+    $name = clean_param($name, PARAM_FILE);
     $filehash = badges_bake($hash, $download, $USER->id, true);
     $fs = get_file_storage();
     $file = $fs->get_file_by_hash($filehash);
diff --git a/lib/badgeslib.php b/lib/badgeslib.php
index 8c42e62845c..b1adc3f6c31 100644
--- a/lib/badgeslib.php
+++ b/lib/badgeslib.php
@@ -1161,6 +1161,7 @@ function badges_download($userid) {
         // Need to make image name user-readable and unique using filename safe characters.
         $name =  $badge->name . ' ' . userdate($issued->dateissued, '%d %b %Y') . ' ' . hash('crc32', $badge->id);
         $name = str_replace(' ', '_', $name);
+        $name = clean_param($name, PARAM_FILE);
         if ($file = $fs->get_file($context->id, 'badges', 'userbadge', $issued->badgeid, '/', $issued->uniquehash . '.png')) {
             $filelist[$name . '.png'] = $file;
         }