MDL-18820 add module_is_moddata_trusted() callback to file.php (improved anti XSS protection for contrib modules); HEAD already has this feature

file.php

@@ -124,17 +124,23 @@
     }
 
     // security: force download of all attachments submitted by students
-    if ((count($args) >= 3)
-        and (strtolower($args[1]) == 'moddata')
-        and ((strtolower($args[2]) == 'forum')
-            or (strtolower($args[2]) == 'assignment')
-            or (strtolower($args[2]) == 'data')
-            or (strtolower($args[2]) == 'glossary')
-            or (strtolower($args[2]) == 'wiki')
-            or (strtolower($args[2]) == 'exercise')
-            or (strtolower($args[2]) == 'workshop')
-            )) {
-        $forcedownload  = 1; // force download of all attachments
+    if (count($args) >= 3 and strtolower($args[1]) === 'moddata') {
+        $mod = clean_param($args[2], PARAM_SAFEDIR);
+        if (file_exists("$CFG->dirroot/mod/$mod/lib.php")) {
+            if (!$forcedownload) {
+                require_once("$CFG->dirroot/mod/$mod/lib.php");
+                $trustedfunction = $mod.'_is_moddata_trusted';
+                if (function_exists($trustedfunction)) {
+                    // force download of all attachments that are not trusted
+                    $forcedownload = !$trustedfunction();
+                } else {
+                    $forcedownload = 1;
+                }
+            }
+        } else {
+            // module is not installed - better not serve file at all
+            not_found($course->id);
+        }
     }
     if ($args[0] == 'blog') {
         $forcedownload  = 1; // force download of all attachments

mod/hotpot/lib.php

@@ -2661,4 +2661,13 @@ function hotpot_reset_course_form_definition(&$mform) {
 function hotpot_reset_course_form_defaults($course) {
     return array('reset_hotpot_deleteallattempts' => 1);
 }
+
+/**
+ * Tells if files in moddata are trusted and can be served without XSS protection.
+ * @return bool true if file can be submitted by teacher only (trusted), false otherwise
+ */
+function hotpot_is_moddata_trusted() {
+    return true;
+}
+
 ?>

mod/lesson/lib.php

@@ -672,4 +672,12 @@ function lesson_get_extra_capabilities() {
     return array('moodle/site:accessallgroups');
 }
 
+/**
+ * Tells if files in moddata are trusted and can be served without XSS protection.
+ * @return bool true if file can be submitted by teacher only (trusted), false otherwise
+ */
+function resource_is_moddata_trusted() {
+    return true;
+}
+
 ?>

mod/resource/lib.php

@@ -697,4 +697,12 @@ function resource_get_name($type) {
     return $name;
 }
 
+/**
+ * Tells if files in moddata are trusted and can be served without XSS protection.
+ * @return bool true if file can be submitted by teacher only (trusted), false otherwise
+ */
+function resource_is_moddata_trusted() {
+    return true;
+}
+
 ?>

mod/scorm/lib.php

@@ -643,4 +643,12 @@ function scorm_get_extra_capabilities() {
     return array('moodle/site:accessallgroups');
 }
 
+/**
+ * Tells if files in moddata are trusted and can be served without XSS protection.
+ * @return bool true if file can be submitted by teacher only (trusted), false otherwise
+ */
+function scorm_is_moddata_trusted() {
+    return true;
+}
+
 ?>