From 5e57bfffac383a0c27133392bfdbcd281597e7cd Mon Sep 17 00:00:00 2001
From: Michael Hawkins <michaelh@moodle.com>
Date: Thu, 2 Mar 2023 12:38:43 +0800
Subject: [PATCH] MDL-77204 mod_wiki: Clean filename in Moodle1 backup

---
 mod/wiki/backup/moodle1/lib.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/mod/wiki/backup/moodle1/lib.php b/mod/wiki/backup/moodle1/lib.php
index 1facfe191a2..a06a899ec6e 100644
--- a/mod/wiki/backup/moodle1/lib.php
+++ b/mod/wiki/backup/moodle1/lib.php
@@ -139,8 +139,9 @@ class moodle1_mod_wiki_handler extends moodle1_mod_handler {
         if (!empty($data['initialcontent'])) {
             //convert file in <INITIALCONTENT>filename</INITIALCONTENT> into a subwiki page if no entry created.
             $temppath = $this->converter->get_tempdir_path();
-            $this->initialcontent = file_get_contents($temppath.'/course_files/'.$data['initialcontent']);
-            $this->initialcontentfilename = $data['initialcontent'];
+            $filename = clean_param($data['initialcontent'], PARAM_FILE);
+            $this->initialcontent = file_get_contents($temppath . '/course_files/' . $filename);
+            $this->initialcontentfilename = $filename;
             $this->needinitpage = true;
         }
         unset($data['initialcontent']);