MDL-66377 user: Only allow active users to retrieve files via tokenpl…

…uginfile.php
ralferlebach · Nov 5, 2019 · 6d51e13 · 6d51e13
1 parent 6330d48
commit 6d51e13
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/lib/moodlelib.php b/lib/moodlelib.php
@@ -3258,6 +3258,8 @@ function require_user_key_login($script, $instance = null, $keyvalue = null) {
         print_error('invaliduserid');
     }
 
+    core_user::require_active_user($user, true, true);
+
     // Emulate normal session.
     enrol_check_plugins($user);
     \core\session\manager::set_user($user);

diff --git a/tokenpluginfile.php b/tokenpluginfile.php
@@ -37,6 +37,7 @@
     $relativepath = ltrim($relativepath, '/');
     $pathparts = explode('/', $relativepath, 2);
     $token = $pathparts[0];
+    $token = clean_param($token, PARAM_ALPHANUM);
     $relativepath = "/{$pathparts[1]}";
 }