Security: Plugin: VChamilo: Verify course container real root

Fix GHSA-c4fc-vjm9-9mvc

Author: AngelFQC

plugin/vchamilo/views/manage.testdatapath.php

@@ -11,6 +11,9 @@
  */
 
 // Loading configuration.
+use Symfony\Component\Filesystem\Filesystem;
+use Symfony\Component\Finder\Finder;
+
 require_once __DIR__.'/../../../main/inc/global.inc.php';
 
 api_protect_admin_script();
@@ -21,38 +24,50 @@
 $dataroot = $_REQUEST['dataroot'];
 
 $absalternatecourse = Virtual::getConfig('vchamilo', 'course_real_root');
-if (!empty($absalternatecourse)) {
-    // this is the relocated case
-    $coursedir = str_replace('//', '/', $absalternatecourse.'/'.$dataroot);
-} else {
-    // this is the standard local case
-    $coursedir = api_get_path(SYS_PATH).$dataroot;
-}
 
-if (is_dir($coursedir)) {
-    $DIR = opendir($coursedir);
-    $cpt = 0;
-    $hasfiles = false;
-    while (($file = readdir($DIR)) && !$hasfiles) {
-        if (!preg_match("/^\\./", $file)) {
-            $hasfiles = true;
+try {
+    if (!empty($absalternatecourse)) {
+        if (!is_dir($absalternatecourse) || !realpath($absalternatecourse)) {
+            throw new Exception("$absalternatecourse is not a directory");
         }
-    }
-    closedir($DIR);
 
-    if ($hasfiles) {
-        echo '<div class="error">'.$plugin->get_lang('datapathnotavailable').'</div>';
+        $absalternatecourse = realpath($absalternatecourse);
+
+        // this is the relocated case
+        $coursedir = str_replace('//', '/', $absalternatecourse.'/'.$dataroot);
     } else {
-        echo '<div class="success">'.$plugin->get_lang('datapathavailable').'</div>';
+        // this is the standard local case
+        $coursedir = api_get_path(SYS_PATH).$dataroot;
     }
-    echo stripslashes($coursedir);
-} else {
-    if (@mkdir($coursedir, 02777, true)) {
-        echo '<div class="success">'.$plugin->get_lang('datapathcreated').'</div>';
+
+    $fileSystem = new Filesystem();
+
+    $components = explode('://', $coursedir);
+    $components = array_reverse($components);
+    $coursedir = $components[0];
+
+    if (is_file($coursedir)) {
+        throw new Exception("$coursedir is file");
+    }
+
+    if ($fileSystem->exists($coursedir) && is_dir($coursedir)) {
+        $finder = new Finder();
+        $finder->files()->in($coursedir);
+
+        if ($finder->hasResults()) {
+            echo '<div class="error">'.$plugin->get_lang('datapathnotavailable').'</div>';
+        } else {
+            echo '<div class="success">'.$plugin->get_lang('datapathavailable').'</div>';
+        }
     } else {
-        echo '<div class="error">'.$plugin->get_lang('couldnotcreatedataroot').'</div>';
+        $fileSystem->mkdir($coursedir, 02777);
+
+        echo '<div class="success">'.$plugin->get_lang('datapathcreated').'</div>';
     }
+
     echo stripslashes($coursedir);
+} catch (Exception $exception) {
+    echo '<div class="error">'.$exception->getMessage().'</div>';
 }
 
 echo "</p>";