From c31aa73c703cd60c08c4ba2dcbe30e339cfad971 Mon Sep 17 00:00:00 2001
From: David Mudrak <david.mudrak@gmail.com>
Date: Thu, 17 Jun 2010 15:40:07 +0000
Subject: [PATCH] MDL-22812 Do not change dataroot path passed as argument

Because PARAM_SAFEPATH was applied on dataroot argument, directories
containing dots (eg. /var/www/data/moodle.tld.com) were silently
renamed. The patch removes the input validation on the argument. If the
enemy is executing scripts at the server, you are doomed anyway.
---
 admin/cli/install.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/admin/cli/install.php b/admin/cli/install.php
index 37e12e5eb14..6bf19035746 100644
--- a/admin/cli/install.php
+++ b/admin/cli/install.php
@@ -311,7 +311,7 @@ $CFG->httpswwwroot  = $CFG->wwwroot;
 
 //We need dataroot before lang download
 if (!empty($options['dataroot'])) {
-    $CFG->dataroot = clean_param($options['dataroot'], PARAM_SAFEPATH);
+    $CFG->dataroot = $options['dataroot'];
 }
 if ($interactive) {
     cli_separator();