From b77f5e7a06571b9a6868e397f126ca5552d497e2 Mon Sep 17 00:00:00 2001
From: moodler <moodler>
Date: Wed, 29 Sep 2004 05:33:00 +0000
Subject: [PATCH] Fixes to check path names properly

---
 admin/auth.php   | 1 +
 admin/enrol.php  | 5 ++++-
 admin/module.php | 1 +
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/admin/auth.php b/admin/auth.php
index fb804b8c332..5786680c53e 100644
--- a/admin/auth.php
+++ b/admin/auth.php
@@ -53,6 +53,7 @@
 	} else {
         $auth = $config->auth;
 	} 
+    $auth = clean_filename($auth);
     require_once("$CFG->dirroot/auth/$auth/lib.php"); //just to make sure that current authentication functions are loaded
     if (! isset($config->guestloginbutton)) {
         $config->guestloginbutton = 1;
diff --git a/admin/enrol.php b/admin/enrol.php
index c43986c1104..30561b4e831 100644
--- a/admin/enrol.php
+++ b/admin/enrol.php
@@ -3,8 +3,10 @@
        //             Yes, enrol is correct English spelling.
 
     include("../config.php");
+
+    $enrol = (string)parameter('enrol', $CFG->enrol);
+
     require_login();
-    optional_variable($enrol, $CFG->enrol);
 
     if (!$site = get_site()) {
         redirect("index.php");
@@ -14,6 +16,7 @@
         error("Only the admin can use this page");
     }
 
+    $enrol = clean_filename($enrol);
     require_once("$CFG->dirroot/enrol/$enrol/enrol.php");   /// Open the class
 
     $enrolment = new enrolment_plugin();
diff --git a/admin/module.php b/admin/module.php
index a4466663f1d..3985475d244 100644
--- a/admin/module.php
+++ b/admin/module.php
@@ -29,6 +29,7 @@
 
     require_variable($module);
 
+    $module = clean_filename($module);
 	require_once("$CFG->dirroot/mod/$module/lib.php");