Browse Source

Revert "Improve validation to download documents - refs BT#15024"

This reverts commit 964f41e74ed9895f451205dd82b3b36e8293770c.
Angel Fernando Quiroz Campos 6 years ago
parent
commit
16bdfd9c87
1 changed files with 6 additions and 10 deletions
  1. 6 10
      main/document/download.php

+ 6 - 10
main/document/download.php

@@ -26,16 +26,10 @@ $doc_url = str_replace('///', '&', $doc_url);
 // Still a space present? it must be a '+' (that got replaced by mod_rewrite)
 $doc_url = str_replace(' ', '+', $doc_url);
 
-$sys_course_path = api_get_path(SYS_COURSE_PATH).$_course['path'].'/document';
-$docRealPath = realpath($sys_course_path.$doc_url);
-
-if (
-    false === $docRealPath ||
-    0 !== strpos($docRealPath, $sys_course_path.$doc_url)
-) {
-    api_not_allowed(
-        !empty($_GET['origin']) && $_GET['origin'] === 'learnpath'
-    );
+$doc_url = str_replace(['../', '\\..', '\\0', '..\\'], ['', '', '', ''], $doc_url); //echo $doc_url;
+
+if (strpos($doc_url, '../') || strpos($doc_url, '/..')) {
+    $doc_url = '';
 }
 
 // Dealing with image included into survey: when users receive a link towards a
@@ -44,6 +38,8 @@ if (
 // inteface.
 $refer_script = isset($_SERVER["HTTP_REFERER"]) ? strrchr($_SERVER["HTTP_REFERER"], '/') : null;
 
+$sys_course_path = api_get_path(SYS_COURSE_PATH).$_course['path'].'/document';
+
 if (substr($refer_script, 0, 15) == '/fillsurvey.php') {
     $invitation = substr(strstr($refer_script, 'invitationcode='), 15);
     $course = strstr($refer_script, 'course=');