c31aa73c70
Because PARAM_SAFEPATH was applied on dataroot argument, directories containing dots (eg. /var/www/data/moodle.tld.com) were silently renamed. The patch removes the input validation on the argument. If the enemy is executing scripts at the server, you are doomed anyway.