From 676e4d456904e201ad8cda93ec24b0e153a2ca24 Mon Sep 17 00:00:00 2001
From: skodak <skodak>
Date: Thu, 9 Apr 2009 09:30:31 +0000
Subject: [PATCH] MDL-18820 add module_is_moddata_trusted() callback to
 file.php (improved anti XSS protection for contrib modules); HEAD already has
 this feature

---
 file.php             | 28 +++++++++++++++++-----------
 mod/hotpot/lib.php   |  9 +++++++++
 mod/lesson/lib.php   |  8 ++++++++
 mod/resource/lib.php |  8 ++++++++
 mod/scorm/lib.php    |  8 ++++++++
 5 files changed, 50 insertions(+), 11 deletions(-)

diff --git a/file.php b/file.php
index b5486d2360c..f2a4b966b8d 100644
--- a/file.php
+++ b/file.php
@@ -124,17 +124,23 @@
     }
 
     // security: force download of all attachments submitted by students
-    if ((count($args) >= 3)
-        and (strtolower($args[1]) == 'moddata')
-        and ((strtolower($args[2]) == 'forum')
-            or (strtolower($args[2]) == 'assignment')
-            or (strtolower($args[2]) == 'data')
-            or (strtolower($args[2]) == 'glossary')
-            or (strtolower($args[2]) == 'wiki')
-            or (strtolower($args[2]) == 'exercise')
-            or (strtolower($args[2]) == 'workshop')
-            )) {
-        $forcedownload  = 1; // force download of all attachments
+    if (count($args) >= 3 and strtolower($args[1]) === 'moddata') {
+        $mod = clean_param($args[2], PARAM_SAFEDIR);
+        if (file_exists("$CFG->dirroot/mod/$mod/lib.php")) {
+            if (!$forcedownload) {
+                require_once("$CFG->dirroot/mod/$mod/lib.php");
+                $trustedfunction = $mod.'_is_moddata_trusted';
+                if (function_exists($trustedfunction)) {
+                    // force download of all attachments that are not trusted
+                    $forcedownload = !$trustedfunction();
+                } else {
+                    $forcedownload = 1;
+                }
+            }
+        } else {
+            // module is not installed - better not serve file at all
+            not_found($course->id);
+        }
     }
     if ($args[0] == 'blog') {
         $forcedownload  = 1; // force download of all attachments
diff --git a/mod/hotpot/lib.php b/mod/hotpot/lib.php
index 2ae087ab102..e5984260025 100644
--- a/mod/hotpot/lib.php
+++ b/mod/hotpot/lib.php
@@ -2661,4 +2661,13 @@ function hotpot_reset_course_form_definition(&$mform) {
 function hotpot_reset_course_form_defaults($course) {
     return array('reset_hotpot_deleteallattempts' => 1);
 }
+
+/**
+ * Tells if files in moddata are trusted and can be served without XSS protection.
+ * @return bool true if file can be submitted by teacher only (trusted), false otherwise
+ */
+function hotpot_is_moddata_trusted() {
+    return true;
+}
+
 ?>
\ No newline at end of file
diff --git a/mod/lesson/lib.php b/mod/lesson/lib.php
index df73721b5c2..14ded747ee7 100644
--- a/mod/lesson/lib.php
+++ b/mod/lesson/lib.php
@@ -672,4 +672,12 @@ function lesson_get_extra_capabilities() {
     return array('moodle/site:accessallgroups');
 }
 
+/**
+ * Tells if files in moddata are trusted and can be served without XSS protection.
+ * @return bool true if file can be submitted by teacher only (trusted), false otherwise
+ */
+function resource_is_moddata_trusted() {
+    return true;
+}
+
 ?>
diff --git a/mod/resource/lib.php b/mod/resource/lib.php
index 8b24843dc57..70a502a61e5 100644
--- a/mod/resource/lib.php
+++ b/mod/resource/lib.php
@@ -697,4 +697,12 @@ function resource_get_name($type) {
     return $name;
 }
 
+/**
+ * Tells if files in moddata are trusted and can be served without XSS protection.
+ * @return bool true if file can be submitted by teacher only (trusted), false otherwise
+ */
+function resource_is_moddata_trusted() {
+    return true;
+}
+
 ?>
diff --git a/mod/scorm/lib.php b/mod/scorm/lib.php
index d2e81290efb..3b7ad63fb58 100755
--- a/mod/scorm/lib.php
+++ b/mod/scorm/lib.php
@@ -643,4 +643,12 @@ function scorm_get_extra_capabilities() {
     return array('moodle/site:accessallgroups');
 }
 
+/**
+ * Tells if files in moddata are trusted and can be served without XSS protection.
+ * @return bool true if file can be submitted by teacher only (trusted), false otherwise
+ */
+function scorm_is_moddata_trusted() {
+    return true;
+}
+
 ?>
\ No newline at end of file