L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

had to change this a bit because blogs use different location to store rss, as it is not a module, please warn if this is a security issue

Browse Source
This commit is contained in:
toyomoyo
2006-03-17 07:37:27 +00:00
parent 29e2dd37ea
commit 7fe0ce4e6a
1 changed files with 20 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rss/file.php
+20 -15
View File
@@ -6,7 +6,7 @@
// name: the name of the module (forum...)
// id: the id (instance) of the module (forumid...)
//If the course has a password or it doesn't
//allow guest access then the user field is
//allow guest access then the user field is
//required to see that the user is enrolled
//in the course, else no check is performed.
//This allows to limit a bit the rss access
@@ -14,24 +14,26 @@
//obviously, but its the best I've thought!!
$nomoodlecookie = true; // Because it interferes with caching
require_once('../config.php');
require_once($CFG->libdir.'/filelib.php');
require_once($CFG->libdir.'/rsslib.php');
$lifetime = 3600; // Seconds for files to remain in caches - 1 hour
$relativepath = get_file_argument('file.php');
if (!$relativepath) {
not_found();
}
// extract relative path components
$args = explode('/', trim($relativepath, '/'));
if (count($args) < 5) {
$isblog = ($args[0] == 'blogs');
if (count($args) < 5 && !$isblog) {
not_found();
}
@@ -40,19 +42,19 @@
$modulename = clean_param($args[2], PARAM_FILE);
$instance = (int)$args[3];
$filename = 'rss.xml';
if (!$course = get_record("course", "id", $courseid)) {
if ((!$course = get_record("course", "id", $courseid)) && !$isblog) {
not_found();
}
//Check name of module
$mods = get_list_of_plugins("mod");
if (!in_array(strtolower($modulename), $mods)) {
if (!in_array(strtolower($modulename), $mods) && !$isblog) {
not_found();
}
//Get course_module to check it's visible
if (!$cm = get_coursemodule_from_instance($modulename,$instance,$courseid)) {
if (!$isblog && (!$cm = get_coursemodule_from_instance($modulename,$instance,$courseid)) ) {
not_found();
}
@@ -61,18 +63,21 @@
//Check for "security" if !course->guest or course->password
if ($course->id != SITEID) {
if ((!$course->guest || $course->password) && (!($isstudent || $isteacher))) {
if (((!$course->guest || $course->password) && (!($isstudent || $isteacher))) && !$isblog) {
not_found();
}
}
//Check for "security" if the course is hidden or the activity is hidden
if ((!$course->visible || !$cm->visible) && (!$isteacher)) {
//Check for "security" if the course is hidden or the activity is hidden
if (((!$course->visible || !$cm->visible) && (!$isteacher)) && !$isblog) {
not_found();
}
$pathname = $CFG->dataroot.'/rss/'.$modulename.'/'.$instance.'.xml';
if ($isblog) {
$pathname = $CFG->dataroot.'/rss/'.$relativepath;
} else {
$pathname = $CFG->dataroot.'/rss/'.$modulename.'/'.$instance.'.xml';
}
//Check that file exists
if (!file_exists($pathname)) {
not_found();