From 5e968b8864114f958a40d284bfa214983cefffa1 Mon Sep 17 00:00:00 2001
From: Paul Holden <paulh@moodle.com>
Date: Mon, 13 Nov 2023 09:27:06 +0000
Subject: [PATCH] MDL-80088 mod_imscp: better uploaded package filetype
 validation.

---
 lib/classes/filetypes.php |  1 +
 mod/imscp/mod_form.php    | 18 ++++--------------
 2 files changed, 5 insertions(+), 14 deletions(-)

diff --git a/lib/classes/filetypes.php b/lib/classes/filetypes.php
index cd91993f6cd..3b0be4b591b 100644
--- a/lib/classes/filetypes.php
+++ b/lib/classes/filetypes.php
@@ -127,6 +127,7 @@ abstract class core_filetypes {
             'ico' => array('type' => 'image/vnd.microsoft.icon', 'icon' => 'image',
                     'groups' => array('image'), 'string' => 'image'),
             'ics' => array('type' => 'text/calendar', 'icon' => 'text'),
+            'imscc' => array('type' => 'application/zip', 'icon' => 'archive', 'string' => 'archive'),
             'isf' => array('type' => 'application/inspiration', 'icon' => 'isf'),
             'ist' => array('type' => 'application/inspiration.template', 'icon' => 'isf'),
             'java' => array('type' => 'text/plain', 'icon' => 'sourcecode'),
diff --git a/mod/imscp/mod_form.php b/mod/imscp/mod_form.php
index d93baf90add..a8a0eabb394 100644
--- a/mod/imscp/mod_form.php
+++ b/mod/imscp/mod_form.php
@@ -59,7 +59,9 @@ class mod_imscp_mod_form extends moodleform_mod {
         // IMS-CP file upload.
         $mform->addElement('header', 'content', get_string('contentheader', 'imscp'));
         $mform->setExpanded('content', true);
-        $mform->addElement('filepicker', 'package', get_string('packagefile', 'imscp'));
+
+        $mform->addElement('filepicker', 'package', get_string('packagefile', 'imscp'), null,
+            ['accepted_types' => ['application/zip', '.imscc']]);
 
         $options = array('-1' => get_string('all'), '0' => get_string('no'),
                          '1' => '1', '2' => '2', '5' => '5', '10' => '10', '20' => '20');
@@ -78,27 +80,15 @@ class mod_imscp_mod_form extends moodleform_mod {
      * @param array $files
      */
     public function validation($data, $files) {
-        global $USER;
-
         if ($errors = parent::validation($data, $files)) {
             return $errors;
         }
 
-        $usercontext = context_user::instance($USER->id);
-        $fs = get_file_storage();
-
-        if (!$files = $fs->get_area_files($usercontext->id, 'user', 'draft', $data['package'], 'id', false)) {
+        if (!$this->get_draft_files('package')) {
             if (!$this->current->instance) {
                 $errors['package'] = get_string('required');
                 return $errors;
             }
-        } else {
-            $file = reset($files);
-            if ($file->get_mimetype() != 'application/zip') {
-                $errors['package'] = get_string('invalidfiletype', 'error', '', $file);
-                // Better delete current file, it is not usable anyway.
-                $fs->delete_area_files($usercontext->id, 'user', 'draft', $data['package']);
-            }
         }
 
         return $errors;