From 6983a17fc0e6cf43cfc0ace8a87bce13d6813dfc Mon Sep 17 00:00:00 2001
From: Petr Skoda <commits@skodak.org>
Date: Fri, 15 Jul 2022 19:06:28 +0200
Subject: [PATCH] MDL-75237 core: Revert MDL-72029

This reverts commit 9f270d956e238a185e47f7f47e0971f652360445.
---
 lib/moodlelib.php            | 14 ++------------
 lib/tests/moodlelib_test.php | 34 ----------------------------------
 2 files changed, 2 insertions(+), 46 deletions(-)

diff --git a/lib/moodlelib.php b/lib/moodlelib.php
index 5501df4be75..bd83cf2102c 100644
--- a/lib/moodlelib.php
+++ b/lib/moodlelib.php
@@ -978,18 +978,8 @@ function clean_param($param, $type) {
             return preg_replace('/[^a-zA-Z0-9_-]/i', '', $param);
 
         case PARAM_SAFEPATH:
-            // Replace MS \ separators.
-            $param = str_replace('\\', '/', $param);
-            // Remove any number of ../ to prevent path traversal.
-            $param = preg_replace('/\.\.+\//', '', $param);
-            // Remove everything not a-zA-Z0-9/:_- .
-            $param = preg_replace('/[^a-zA-Z0-9\/:_-]/i', '', $param);
-            // Remove leading slash.
-            $param = ltrim($param, '/');
-            if ($param === '.') {
-                $param = '';
-            }
-            return $param;
+            // Remove everything not a-zA-Z0-9/_- .
+            return preg_replace('/[^a-zA-Z0-9\/_-]/i', '', $param);
 
         case PARAM_FILE:
             // Strip all suspicious characters from filename.
diff --git a/lib/tests/moodlelib_test.php b/lib/tests/moodlelib_test.php
index f8574642319..e19590ecff2 100644
--- a/lib/tests/moodlelib_test.php
+++ b/lib/tests/moodlelib_test.php
@@ -839,40 +839,6 @@ class core_moodlelib_testcase extends advanced_testcase {
         }
     }
 
-    /**
-     * Provide some tested base url and expected results.
-     *
-     * @return array Array of tested base url and expected results.
-     */
-    public function clean_param_safepath_provider(): array {
-        return [
-            // MS separator test.
-            ['c:\temp', 'c:/temp'],
-
-            // Leading slash test.
-            ['/tmp/', 'tmp/'],
-
-            // Path traversal test.
-            ['../../../../../etc/', 'etc/'],
-            ['../', ''],
-            ['.../...//', ''],
-            ['.', '']
-        ];
-    }
-
-    /**
-     * Test clean_param() method with PARAM_SAFEPATH type.
-     *
-     * @dataProvider clean_param_safepath_provider
-     * @covers ::clean_param
-     * @param string $path
-     * @param string $expected
-     */
-    public function test_clean_param_safepath(string $path, string $expected) {
-        $result = clean_param($path, PARAM_SAFEPATH);
-        $this->assertSame($expected, $result);
-    }
-
     public function test_validate_param() {
         try {
             $param = validate_param('11a', PARAM_INT);