MDL-77204 mod_wiki: Clean filename in Moodle1 backup

moodle · Mar 8, 2023 · 11acdd8 · 11acdd8
1 parent 5a9cc63
commit 11acdd8
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/mod/wiki/backup/moodle1/lib.php b/mod/wiki/backup/moodle1/lib.php
@@ -139,8 +139,9 @@ public function process_wiki($data) {
         if (!empty($data['initialcontent'])) {
             //convert file in <INITIALCONTENT>filename</INITIALCONTENT> into a subwiki page if no entry created.
             $temppath = $this->converter->get_tempdir_path();
-            $this->initialcontent = file_get_contents($temppath.'/course_files/'.$data['initialcontent']);
-            $this->initialcontentfilename = $data['initialcontent'];
+            $filename = clean_param($data['initialcontent'], PARAM_FILE);
+            $this->initialcontent = file_get_contents($temppath . '/course_files/' . $filename);
+            $this->initialcontentfilename = $filename;
             $this->needinitpage = true;
         }
         unset($data['initialcontent']);