From e40bd2e541aded6f4f07a2e8a2eca7428fcf5865 Mon Sep 17 00:00:00 2001
From: moodler <moodler>
Date: Wed, 29 Sep 2004 06:56:55 +0000
Subject: [PATCH] Safer processing of pathnames

---
 mod/lesson/import.php | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/mod/lesson/import.php b/mod/lesson/import.php
index c82b7756b54..2160449fa87 100644
--- a/mod/lesson/import.php
+++ b/mod/lesson/import.php
@@ -34,6 +34,8 @@
 
     if ($form = data_submitted()) {   /// Filename
 
+        $form->format = clean_filename($form->format); // For safety
+
         if (isset($form->filename)) {                 // file already on server
             $newfile['tmp_name'] = $form->filename; 
             $newfile['size'] = filesize($form->filename);
@@ -51,12 +53,12 @@
         } else {  // Valid file is found
 
             if (! is_readable("../quiz/format/$form->format/format.php")) {
-                error("Format not known ($form->format)");
+                error("Format not known (".clean_text($form->format).")");
             }
 
             require("format.php");  // Parent class
-            require("../quiz/lib.php"); // for the constants used in quiz/format/<format>/format.php
-            require("../quiz/format/$form->format/format.php");
+            require("$CFG->dirroot/mod/quiz/lib.php"); // for the constants used in quiz/format/<format>/format.php
+            require("$CFG->dirroot/mod/quiz/format/$form->format/format.php");
 
             $format = new quiz_file_format();