From f98f08c00a24e838c5bbdcddf15bafed1d7f4fb6 Mon Sep 17 00:00:00 2001 From: Brendan Heywood Date: Sat, 18 Apr 2020 20:36:44 +1000 Subject: [PATCH] MDL-68443 xmldb: Improve path validation on view_xml action --- admin/tool/xmldb/actions/view_xml/view_xml.class.php | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/admin/tool/xmldb/actions/view_xml/view_xml.class.php b/admin/tool/xmldb/actions/view_xml/view_xml.class.php index 9e6bd0c909f..58f023e3500 100644 --- a/admin/tool/xmldb/actions/view_xml/view_xml.class.php +++ b/admin/tool/xmldb/actions/view_xml/view_xml.class.php @@ -68,13 +68,13 @@ class view_xml extends XMLDBAction { // Get the file parameter $file = required_param('file', PARAM_PATH); - $file = $CFG->dirroot . $file; - // File must be under $CFG->wwwroot and - // under one db directory (simple protection) - if (substr($file, 0, strlen($CFG->dirroot)) == $CFG->dirroot && - substr(dirname($file), -2, 2) == 'db') { + + $fullpath = $CFG->dirroot . $file; + // File param must start with / and end with /db/install.xml to be safe. + if (substr($file, 0, 1) == '/' && + substr($file, -15, 15) == '/db/install.xml') { // Everything is ok. Load the file to memory - $this->output = file_get_contents($file); + $this->output = file_get_contents($fullpath); } else { // Switch to HTML and error $this->does_generate = ACTION_GENERATE_HTML;