From 3cafb305ded3bf676a2d2b89fcf5a0c6ea7c6d6d Mon Sep 17 00:00:00 2001 From: Huong Nguyen Date: Fri, 6 May 2022 12:21:39 +0700 Subject: [PATCH] MDL-72029 Lesson: Prevent arbitrary file read when importing lesson questions in blackboard format --- question/format/blackboard_six/format.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/question/format/blackboard_six/format.php b/question/format/blackboard_six/format.php index ddacb205705..3c5a28f54ce 100644 --- a/question/format/blackboard_six/format.php +++ b/question/format/blackboard_six/format.php @@ -152,7 +152,8 @@ class qformat_blackboard_six extends qformat_blackboard_six_base { } if ($examfile->getAttribute('type') == 'assessment/x-bb-pool') { if ($examfile->getAttribute('baseurl')) { - $fileobj->filebase = $this->tempdir. '/' . $examfile->getAttribute('baseurl'); + $fileobj->filebase = clean_param($this->tempdir . '/' + . $examfile->getAttribute('baseurl'), PARAM_SAFEPATH); } if ($content = $this->get_filecontent($examfile->getAttribute('file'))) { $fileobj->filetype = self::FILETYPE_POOL; -- 2.43.0