MDL-81306 core: Do not use xsendfile for request dirs

2024-03-28 09:30:07 +08:00
parent ee06a613b3
commit f0f1caa67d
2 changed files with 178 additions and 0 deletions
@@ -49,6 +49,13 @@ function xsendfile($filepath) {

    $filepath = realpath($filepath);

+    $localrequestdir = realpath($CFG->localrequestdir);
+    if (str_contains($filepath, $localrequestdir)) {
+        // Do not serve files from local request directory using xsendfile.
+        // They are likely to be removed before xsendfile can serve them.
+        return false;
+    }
+
    $aliased = false;
    if (!empty($CFG->xsendfilealiases) and is_array($CFG->xsendfilealiases)) {
        foreach ($CFG->xsendfilealiases as $alias=>$dir) {