MDL-47868 ws: verify upload areas

moodle · Nov 4, 2014 · 2f87351 · 2f87351
1 parent e133160
commit 2f87351
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/webservice/upload.php b/webservice/upload.php
@@ -68,6 +68,11 @@
 $context = context_user::instance($USER->id);
 require_capability('moodle/user:manageownfiles', $context);
 
+if ($filearea !== 'private' and $filearea !== 'draft') {
+    // Do not dare to allow more areas here!
+    throw new file_exception('error');
+}
+
 $fs = get_file_storage();
 
 $totalsize = 0;