mirror_php/moodle
1
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-04-11 19:42:35 +02:00
Code Issues Projects Releases Wiki Activity

MDL-68415 email: Fix attachment in email_to_user()

Browse Source
This commit is contained in:
fujiwara 2020-05-04 21:43:57 +09:00
parent f570a79071
commit c4f51bfd31
1 changed files with 23 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
lib/moodlelib.php
View File

@ -6276,12 +6276,31 @@ function email_to_user($user, $from, $subject, $messagetext, $messagehtml = '',
// Before doing the comparison, make sure that the paths are correct (Windows uses slashes in the other direction).
$attachpath = str_replace('\\', '/', $attachmentpath);
// Make sure both variables are normalised before comparing.
$temppath = str_replace('\\', '/', realpath($CFG->tempdir));
// If the attachment is a full path to a file in the tempdir, use it as is,
// Add allowed paths to an array (also check if it's not empty).
$allowedpaths = array_filter([
$CFG->cachedir,
$CFG->dataroot,
$CFG->dirroot,
$CFG->localcachedir,
$CFG->tempdir
]);
// Set addpath to true.
$addpath = true;
// Check if attachment includes one of the allowed paths.
foreach ($allowedpaths as $tmpvar) {
// Make sure both variables are normalised before comparing.
$temppath = str_replace('\\', '/', realpath($tmpvar));
// Set addpath to false if the attachment includes one of the allowed paths.
if (strpos($attachpath, $temppath) === 0) {
$addpath = false;
break;
}
}
// If the attachment is a full path to a file in the multiple allowed paths, use it as is,
// otherwise assume it is a relative path from the dataroot (for backwards compatibility reasons).
if (strpos($attachpath, $temppath) !== 0) {
if ($addpath == true) {
$attachmentpath = $CFG->dataroot . '/' . $attachmentpath;
}