Fixes to check path names properly

admin/auth.php

@@ -53,6 +53,7 @@
 	} else {
         $auth = $config->auth;
 	} 
+    $auth = clean_filename($auth);
     require_once("$CFG->dirroot/auth/$auth/lib.php"); //just to make sure that current authentication functions are loaded
     if (! isset($config->guestloginbutton)) {
         $config->guestloginbutton = 1;

admin/enrol.php

@@ -3,8 +3,10 @@
        //             Yes, enrol is correct English spelling.
 
     include("../config.php");
+
+    $enrol = (string)parameter('enrol', $CFG->enrol);
+
     require_login();
-    optional_variable($enrol, $CFG->enrol);
 
     if (!$site = get_site()) {
         redirect("index.php");
@@ -14,6 +16,7 @@
         error("Only the admin can use this page");
     }
 
+    $enrol = clean_filename($enrol);
     require_once("$CFG->dirroot/enrol/$enrol/enrol.php");   /// Open the class
 
     $enrolment = new enrolment_plugin();

admin/module.php

@@ -29,6 +29,7 @@
 
     require_variable($module);
 
+    $module = clean_filename($module);
 	require_once("$CFG->dirroot/mod/$module/lib.php");