basic detection of sites with misconfigured dataroot SC#295

admin/index.php

@@ -403,6 +403,10 @@
         print_simple_box(get_string('globalsquoteswarning', 'admin'), 'center', '60%');
     }
 
+    if (is_dataroot_insecure()) {
+        print_simple_box(get_string('datarootsecuritywarning', 'admin', $CFG->dataroot), 'center', '60%');
+    }
+
 /// If no recently cron run
     $lastcron = get_field_sql('SELECT max(lastcron) FROM ' . $CFG->prefix . 'modules');
     if (time() - $lastcron > 3600 * 24) {

lang/en_utf8/admin.php

@@ -160,6 +160,7 @@ $string['configzip'] = 'Indicate the location of your zip program (Unix only, op
 $string['confirmation'] = 'Confirmation';
 $string['confirminstall'] = 'You are about to install language pack ($a), are you sure?';
 $string['cronwarning'] = 'The <a href=\"cron.php\">cron.php maintenance script</a> has not been run for at least 24 hours.';
+$string['datarootsecuritywarning'] = 'Your site configuration might not be secure. Please make sure that your dataroot directory ($a) is not directly accesible via web.';
 $string['dbmigrate'] = 'Moodle Database Migration';
 $string['dbmigrationdeprecateddb'] = '<font color=\"#ff0000\">This database is migrated to a new UTF8 database and deprecated. Please edit your config.php and use the new database for this moodle.</font>';
 $string['dbmigrationdupfailed'] = 'Database duplication failed with possible error:<font color=\"#ff0000\"><pre>$a</pre></font>';

lib/adminlib.php

@@ -547,4 +547,34 @@ function upgrade_log_callback($string) {
     return $string;
 }
 
+/**
+ * Try to verify that dataroot is not accessible from web.
+ * It is not 100% correct but might help to reduce number of vulnerable sites.
+ *
+ * Protection from httpd.conf and .htaccess is not detected properly.
+ */
+function is_dataroot_insecure() {
+    global $CFG;
+
+    $siteroot = str_replace('\\', '/', strrev($CFG->dirroot.'/')); // win32 backslash workaround
+
+    $rp = preg_replace('|https?://[^/]+|i', '', $CFG->wwwroot, 1);
+    $rp = strrev(trim($rp, '/'));
+    $rp = explode('/', $rp);
+    foreach($rp as $r) {
+        if (strpos($siteroot, '/'.$r.'/') === 0) {
+            $siteroot = substr($siteroot, strlen($r)+1); // moodle web in subdirectory
+        } else {
+            break; // probably alias root
+        }
+    }
+
+    $siteroot = strrev($siteroot);
+    $dataroot = str_replace('\\', '/', $CFG->dataroot.'/');
+
+    if (strpos($dataroot, $siteroot) === 0) {
+        return true;
+    }
+    return false;
+}
 ?>