check suggested dataroot in install.php SC#295

install.php

@@ -125,6 +125,7 @@
 
 /// Include some moodle libraries
 
+require_once('./lib/adminlib.php');
 require_once('./lib/setuplib.php');
 require_once('./lib/moodlelib.php');
 require_once('./lib/weblib.php');
@@ -145,6 +146,20 @@
 if ($INSTALL['wwwroot'] == '') {
     list($INSTALL['wwwroot'], $xtra) = explode('/install.php', qualified_me());
     $INSTALL['wwwrootform'] = $INSTALL['wwwroot'];
+
+    // now try to guess the correct dataroot not accessible via web
+    $CFG->wwwroot = $INSTALL['wwwroot'];
+    $i = 0; //safety check - dirname might return some unexpected results
+    while(is_dataroot_insecure()) {
+        $parrent = dirname($CFG->dataroot);
+        $i++;
+        if ($parrent == '/' or $parrent == '.' or preg_match('/^[a-z]:\\?$/i', $parrent) or ($i > 100)) {
+            $CFG->dataroot = ''; //can not find secure location for dataroot
+            break;
+        }
+        $CFG->dataroot = dirname($parrent).'/moodledata';
+    }
+    $INSTALL['dataroot'] = $CFG->dataroot;
 }
 
 $headstagetext = array(WELCOME       => get_string('chooselanguagehead', 'install'),

lang/en_utf8/install.php

@@ -92,7 +92,7 @@
 <p><b>Data Directory:</b>
 You need a place where Moodle can save uploaded files.  This
 directory should be readable AND WRITEABLE by the web server user 
-(usually \'nobody\' or \'apache\'), but it should not be accessible 
+(usually \'nobody\' or \'apache\'), but it must not be accessible 
 directly via the web.</p>';
 $string['directorysettingshead'] = 'Please confirm the locations of this Moodle installation';
 $string['directorysettingssub'] ='<b>Web Address:</b>