From ce534d5dfaf58104f559808d076d5129a71ce7cb Mon Sep 17 00:00:00 2001 From: Nelson Moller Date: Thu, 22 Jan 2015 08:57:54 -0500 Subject: [PATCH] MDL-48929 repository_filesystem: Valide relative path against realpath On Windows systems, there could have been a mix of back and forward slashes, causing the validation of the relative path to fail. Now we will always get the realpath before comparing. --- repository/filesystem/lib.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/repository/filesystem/lib.php b/repository/filesystem/lib.php index 039616b8ddf..b40e757fb37 100644 --- a/repository/filesystem/lib.php +++ b/repository/filesystem/lib.php @@ -575,7 +575,7 @@ class repository_filesystem extends repository { $fullrelativefilepath = realpath($this->get_rootpath().$basepath.$relativepath); // Sanity check to make sure this path is inside this repository and the file exists. - if (strpos($fullrelativefilepath, $this->get_rootpath()) === 0 && file_exists($fullrelativefilepath)) { + if (strpos($fullrelativefilepath, realpath($this->get_rootpath())) === 0 && file_exists($fullrelativefilepath)) { send_file($fullrelativefilepath, basename($relativepath), null, 0); } } @@ -665,4 +665,4 @@ function repository_filesystem_cron() { $instances[$itemid]->remove_obsolete_thumbnails($files); } } -} \ No newline at end of file +}