From ccd99f576aea73b34df0cea828279efee66d8db4 Mon Sep 17 00:00:00 2001
From: skodak <skodak>
Date: Tue, 6 Jan 2009 13:10:00 +0000
Subject: [PATCH] MDL-17789 prevent potential XSS problems through PHP_SELF;
 backported from HEAD

---
 lib/setup.php | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/setup.php b/lib/setup.php
index fc8607154d7..486ea5d5141 100644
--- a/lib/setup.php
+++ b/lib/setup.php
@@ -454,6 +454,14 @@ global $HTTPSPAGEREQUIRED;
         }
     }
 
+/// neutralise nasty chars in PHP_SELF
+    if (isset($_SERVER['PHP_SELF'])) {
+        $phppos = strpos($_SERVER['PHP_SELF'], '.php');
+        if ($phppos !== false) {
+            $_SERVER['PHP_SELF'] = substr($_SERVER['PHP_SELF'], 0, $phppos+4);
+        }
+        unset($phppos);
+    }
 
 /// The following code can emulate "register globals" if required.
 /// This hack is no longer being applied as of Moodle 1.6 unless you really