L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-87612 repository: safer unserializing of file source data.

Browse Source
This commit is contained in:
Paul Holden
2026-02-05 12:03:16 +08:00
committed by Mihail Geshoski
parent 071504114a
commit ea1b0eb4e1
2 changed files with 14 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
repository/coursefiles/lib.php
+2 -3
View File
@@ -146,12 +146,11 @@ class repository_coursefiles extends repository {
}
public function get_link($encoded) {
$info = array();
$browser = get_file_browser();
// the final file
$params = unserialize(base64_decode($encoded));
$params = (array) unserialize_array(base64_decode($encoded));
$contextid = clean_param($params['contextid'], PARAM_INT);
$fileitemid = clean_param($params['itemid'], PARAM_INT);
$filename = clean_param($params['filename'], PARAM_FILE);
repository/lib.php
+12 -7
View File
@@ -2511,7 +2511,7 @@ abstract class repository implements cacheable_object {
if ($file = $fs->get_file($user_context->id, 'user', 'draft', $itemid, $filepath, $filename)) {
if ($tempfile = $fs->get_file($user_context->id, 'user', 'draft', $itemid, $newfilepath, $newfilename)) {
// Remember original file source field.
$source = @unserialize($file->get_source());
$source = unserialize_object($file->get_source());
// Remember the original sortorder.
$sortorder = $file->get_sortorder();
if ($tempfile->is_external_file()) {
@@ -2526,9 +2526,7 @@ abstract class repository implements cacheable_object {
$newfile = $fs->create_file_from_storedfile(array('filepath'=>$filepath, 'filename'=>$filename), $tempfile);
// Preserve original file location (stored in source field) for handling references
if (isset($source->original)) {
if (!($newfilesource = @unserialize($newfile->get_source()))) {
$newfilesource = new stdClass();
}
$newfilesource = unserialize_object($newfile->get_source());
$newfilesource->original = $source->original;
$newfile->set_source(serialize($newfilesource));
}
@@ -2577,10 +2575,14 @@ abstract class repository implements cacheable_object {
if ($fs->file_exists($usercontext->id, 'user', 'draft', $draftid, $updatedata['filepath'], $updatedata['filename'])) {
throw new moodle_exception('fileexists', 'repository');
}
if (($filesource = @unserialize($file->get_source())) && isset($filesource->original)) {
// Unset original so the references are not shown any more.
$filesource = unserialize_object($file->get_source());
if (isset($filesource->original)) {
unset($filesource->original);
$file->set_source(serialize($filesource));
}
$file->rename($updatedata['filepath'], $updatedata['filename']);
// timemodified is updated only when file is renamed and not updated when file is moved.
$filemodified = $filemodified || ($updatedata['filename'] !== $filename);
@@ -2623,11 +2625,14 @@ abstract class repository implements cacheable_object {
foreach ($files as $f) {
if (preg_match("|^$xfilepath|", $f->get_filepath())) {
$path = preg_replace("|^$xfilepath|", $updatedata['filepath'], $f->get_filepath());
if (($filesource = @unserialize($f->get_source())) && isset($filesource->original)) {
// unset original so the references are not shown any more
// Unset original so the references are not shown any more.
$filesource = unserialize_object($f->get_source());
if (isset($filesource->original)) {
unset($filesource->original);
$f->set_source(serialize($filesource));
}
$f->rename($path, $f->get_filename());
if ($filemodified && $f->get_filepath() === $updatedata['filepath'] && $f->get_filename() === $filename) {
$f->set_timemodified(time());