From 8de3c9a4b5cb0b36c75d794118e0273e75c1db86 Mon Sep 17 00:00:00 2001
From: Andrew Nicols <andrew@nicols.co.uk>
Date: Wed, 8 Oct 2025 13:57:12 +0800
Subject: [PATCH] MDL-86848 core: Throw exception instead of redirecting on
 /index.php

---
 index.php                | 9 ++++-----
 public/lang/en/error.php | 1 +
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/index.php b/index.php
index 9dff3039f0b..ba0bbb120e3 100644
--- a/index.php
+++ b/index.php
@@ -15,13 +15,12 @@
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
 
 /**
- * This file acts as a redirector to the public directory.
- *
- * Note: This file is not intended to be accessed directly.
+ * Throw an exception when users try to access index.php outside of the web root.
  *
  * @package    core
  * @copyright  Andrew Lyons <andrew@nicols.co.uk>
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
-@header($_SERVER['SERVER_PROTOCOL'] . ' 308 Permanent Redirect');
-@header('Location: ./public/');
+require_once('config.php');
+
+throw new \core\exception\moodle_exception('rootdirpublic', 'error');
diff --git a/public/lang/en/error.php b/public/lang/en/error.php
index 9c72047d586..137a924c045 100644
--- a/public/lang/en/error.php
+++ b/public/lang/en/error.php
@@ -531,6 +531,7 @@ $string['restore_path_element_noobject'] = 'Restore object {$a} is not an object
 $string['restrictedcontextexception'] = 'Sorry, execution of external function violates context restriction.';
 $string['restricteduser'] = 'Sorry, but your current account "{$a}" is restricted from doing that';
 $string['reverseproxyabused'] = 'Reverse proxy enabled so the server cannot be accessed directly.<br />Please contact the server administrator.';
+$string['rootdirpublic'] = 'The Moodle root directory must not be publicly accessible. Please reconfigure your web server to use the `/public` directory instead.';
 $string['rpcerror'] = 'Ooops! Your MNET communication has failed! Here\'s that error message to pass on to your administrator: {$a}';
 $string['secretalreadyused'] = 'Change password confirmation link was already used, password was not changed';
 $string['sectioncantbefound'] = '<p><strong>This content can\'t be found.</strong></p><p>It may have been deleted, or the URL may be incorrect.</p>';