MDL-22812 Do not change dataroot path passed as argument
Because PARAM_SAFEPATH was applied on dataroot argument, directories containing dots (eg. /var/www/data/moodle.tld.com) were silently renamed. The patch removes the input validation on the argument. If the enemy is executing scripts at the server, you are doomed anyway.
This commit is contained in:
@@ -311,7 +311,7 @@ $CFG->httpswwwroot = $CFG->wwwroot;
|
||||
|
||||
//We need dataroot before lang download
|
||||
if (!empty($options['dataroot'])) {
|
||||
$CFG->dataroot = clean_param($options['dataroot'], PARAM_SAFEPATH);
|
||||
$CFG->dataroot = $options['dataroot'];
|
||||
}
|
||||
if ($interactive) {
|
||||
cli_separator();
|
||||
|
||||
Reference in New Issue
Block a user