From b5469f78cbb151c9b820c59f9629ebd250d6d623 Mon Sep 17 00:00:00 2001
From: skodak <skodak>
Date: Thu, 7 May 2009 10:48:28 +0000
Subject: [PATCH] MDL-2307 improved file name cleanup during unzip; backported
 from MOODLE-19_STABLE

---
 lib/moodlelib.php | 40 ++++++++++++++--------------------------
 1 file changed, 14 insertions(+), 26 deletions(-)

diff --git a/lib/moodlelib.php b/lib/moodlelib.php
index bbc2abae78e..dbd16ff700b 100644
--- a/lib/moodlelib.php
+++ b/lib/moodlelib.php
@@ -6549,22 +6549,15 @@ function unzip_file ($zipfile, $destination = '', $showstatus = true) {
         $archive = new PclZip(cleardoubleslashes("$zippath/$zipfilename"));
         if (!$list = $archive->extract(PCLZIP_OPT_PATH, $destpath,
                                        PCLZIP_CB_PRE_EXTRACT, 'unzip_cleanfilename',
-                                       PCLZIP_OPT_EXTRACT_DIR_RESTRICTION, $destpath)) {
-            notice($archive->errorInfo(true));
+                                       PCLZIP_OPT_EXTRACT_DIR_RESTRICTION, $temppath)) {
+            if (!empty($showstatus)) {
+                notice($archive->errorInfo(true));
+            }
             return false;
         }
 
     } else {                     // Use external unzip program
 
-        require_once("$CFG->libdir/filelib.php");
-
-        do {
-            $temppath = "$CFG->dataroot/temp/unzip/".random_string(10);
-        } while (file_exists($temppath));
-        if (!check_dir_exists($temppath, true, true)) {
-            return false;
-        }
-
         $separator = strtoupper(substr(PHP_OS, 0, 3)) === 'WIN' ? ' &' : ' ;';
         $redirection = strtoupper(substr(PHP_OS, 0, 3)) === 'WIN' ? '' : ' 2>&1';
 
@@ -6577,22 +6570,14 @@ function unzip_file ($zipfile, $destination = '', $showstatus = true) {
             $command = str_replace('/','\\',$command);
         }
         Exec($command,$list);
-        if (is_array($list)) {
-            foreach ($list as $linenum=>$line) {
-                 // hide full paths - will not work on win32
-                $line = str_replace($temppath, $destpath, $line);
-                $line =  str_replace($CFG->dataroot, '', $line);
-                $list[$linenum] = $line;
-            }
-        }
-
-        unzip_process_temp_dir($temppath, $destpath);
-        fulldelete($temppath);
     }
 
+    unzip_process_temp_dir($temppath, $destpath);
+    fulldelete($temppath);
+
     //Display some info about the unzip execution
     if ($showstatus) {
-        unzip_show_status($list,$destpath);
+        unzip_show_status($list, $temppath, $destpath);
     }
 
     return true;
@@ -6666,7 +6651,7 @@ function unzip_cleanfilename ($p_event, &$p_header) {
     return 1;
 }
 
-function unzip_show_status ($list,$removepath) {
+function unzip_show_status($list, $removepath, $removepath2) {
 //This function shows the results of the unzip execution
 //depending of the value of the $CFG->zip, results will be
 //text or an array of files.
@@ -6686,7 +6671,8 @@ function unzip_show_status ($list,$removepath) {
         foreach ($list as $item) {
             echo "<tr>";
             $item['filename'] = str_replace(cleardoubleslashes($removepath).'/', "", $item['filename']);
-            print_cell("left", s($item['filename']));
+            $item['filename'] = str_replace(cleardoubleslashes($removepath2).'/', "", $item['filename']);
+            print_cell("left", s(clean_param($item['filename'], PARAM_PATH)));
             if (! $item['folder']) {
                 print_cell("right", display_size($item['size']));
             } else {
@@ -6703,7 +6689,9 @@ function unzip_show_status ($list,$removepath) {
         print_simple_box_start("center");
         echo "<pre>";
         foreach ($list as $item) {
-            echo s(str_replace(cleardoubleslashes($removepath.'/'), '', $item)).'<br />';
+            $item = str_replace(cleardoubleslashes($removepath.'/'), '', $item);
+            $item = str_replace(cleardoubleslashes($removepath2.'/'), '', $item);
+            echo s($item).'<br />';
         }
         echo "</pre>";
         print_simple_box_end();