MDL-62232 mod_forum: Limit portfolio to files belonging to the post

2018-05-10 09:15:57 +08:00
parent 4191032993
commit 5b89ff626d
1 changed files with 6 additions and 0 deletions
@@ -95,6 +95,12 @@ class forum_portfolio_caller extends portfolio_module_caller_base {
        $fs = get_file_storage();
        if ($this->post) {
            if ($this->attachment) {
+                // Make sure the requested file belongs to this post.
+                $file = $fs->get_file_by_id($this->attachment);
+                if ($file->get_contextid() != $this->modcontext->id
+                    || $file->get_itemid() != $this->post->id) {
+                    throw new portfolio_caller_exception('filenotfound');
+                }
                $this->set_file_and_format_data($this->attachment);
            } else {
                $attach = $fs->get_area_files($this->modcontext->id, 'mod_forum', 'attachment', $this->post->id, 'timemodified', false);