5674 removed check for content dir in course icon

atutor · May 2, 2016 · 02757e2 · 02757e2
1 parent 08bda73
commit 02757e2
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/get_course_icon.php b/get_course_icon.php
@@ -48,8 +48,8 @@
 
 $real = realpath($file);
 // How did this ever work when the stock icons are used instead of a custom one, see mantis 5465
-if (file_exists($real) && (substr($real, 0, strlen(AT_CONTENT_DIR)) == AT_CONTENT_DIR)) {
-//if (file_exists($real)) {
+//if (file_exists($real) && (substr($real, 0, strlen(AT_CONTENT_DIR)) == AT_CONTENT_DIR)) {
+if (file_exists($real)) {
 	header('Content-Disposition: inline; filename="'.$size.$id.'.'.$pathinfo['extension'].'"');
 
 	/**
@@ -63,11 +63,12 @@
 	 * x-sendfile is supported in apache2 and lighttpd 1.5+ (previously
 	 * named x-send-file in lighttpd 1.4)
 	 */
+	$real=preg_replace("/..\/..\/..\//i", "", $real);
 	header('x-Sendfile: '.$real);
 	header('x-Sendfile: ', TRUE); // if we get here then it didn't work
 
 	header('Content-Type: '.$ext);    
-    $real=preg_replace("/..\/..\/..\//i", "", $real);
+
 	@readfile($real);
 	exit;
 } else {