MDL-17207 filter/tex reverting removal of $pathname in

http://cvs.moodle.org/moodle/filter/tex/texed.php?r1=1.8&r2=1.7 This fixes a security problem only triggered with register_globals ON and magic_quotes_gpc OFF which is a very uncommon case
2008-11-11 18:35:14 +00:00
parent c8271c87dc
commit c39f019849
1 changed files with 2 additions and 0 deletions
@@ -31,10 +31,12 @@
        $texexp = str_replace('&lt;','<',$texexp);
        $texexp = str_replace('&gt;','>',$texexp);
        $texexp = preg_replace('!\r\n?!',' ',$texexp);
+        $pathname = "$CFG->dataroot/filter/tex/$image";
        $cmd = tex_filter_get_cmd($pathname, $texexp);
        system($cmd, $status);

        if (file_exists($pathname)) {
+            require_once($CFG->libdir . '/filelib.php');
            send_file($pathname, $image);
        } else {
            echo "Image not found!";