CVE-2013-1831

@@ -526,6 +526,22 @@ function get_exception_info($ex) {
         $debuginfo .= PHP_EOL.'$a contents: '.print_r($a, true);
     }
 
+    // Remove some absolute paths from message and debugging info.
+    $searches = array();
+    $replaces = array();
+    $cfgnames = array('tempdir', 'cachedir', 'themedir',
+        'langmenucachefile', 'langcacheroot', 'dataroot', 'dirroot');
+    foreach ($cfgnames as $cfgname) {
+        if (property_exists($CFG, $cfgname)) {
+            $searches[] = $CFG->$cfgname;
+            $replaces[] = "[$cfgname]";
+        }
+    }
+    if (!empty($searches)) {
+        $message   = str_replace($searches, $replaces, $message);
+        $debuginfo = str_replace($searches, $replaces, $debuginfo);
+    }
+
     // Be careful, no guarantee weblib.php is loaded.
     if (function_exists('clean_text')) {
         $message = clean_text($message);

@@ -71,4 +71,28 @@ public function test_get_docs_url_wwwroot() {
         $this->assertEquals($CFG->wwwroot . '/lib/tests/setuplib_test.php',
                 get_docs_url('%%WWWROOT%%/lib/tests/setuplib_test.php'));
     }
+
+    /**
+     * Test if get_exception_info() removes file system paths
+     */
+    public function test_exception_info_removes_serverpaths() {
+        global $CFG;
+
+        // This doesn't test them all possible ones, but these are set for unit tests.
+        $cfgnames = array('dataroot', 'dirroot', 'tempdir', 'cachedir');
+
+        $fixture  = '';
+        $expected = '';
+        foreach ($cfgnames as $cfgname) {
+            if (!empty($CFG->$cfgname)) {
+                $fixture  .= $CFG->$cfgname.' ';
+                $expected .= "[$cfgname] ";
+            }
+        }
+        $exception     = new moodle_exception('generalexceptionmessage', 'error', '', $fixture, $fixture);
+        $exceptioninfo = get_exception_info($exception);
+
+        $this->assertContains($expected, $exceptioninfo->message, 'Exception message does not contain system paths');
+        $this->assertContains($expected, $exceptioninfo->debuginfo, 'Exception debug info does not contain system paths');
+    }
 }

@@ -526,6 +526,22 @@ function get_exception_info($ex) {
         $debuginfo .= PHP_EOL.'$a contents: '.print_r($a, true);
     }
 
+    // Remove some absolute paths from message and debugging info.
+    $searches = array();
+    $replaces = array();
+    $cfgnames = array('tempdir', 'cachedir', 'themedir',
+        'langmenucachefile', 'langcacheroot', 'dataroot', 'dirroot');
+    foreach ($cfgnames as $cfgname) {
+        if (property_exists($CFG, $cfgname)) {
+            $searches[] = $CFG->$cfgname;
+            $replaces[] = "[$cfgname]";
+        }
+    }
+    if (!empty($searches)) {
+        $message   = str_replace($searches, $replaces, $message);
+        $debuginfo = str_replace($searches, $replaces, $debuginfo);
+    }
+
     // Be careful, no guarantee weblib.php is loaded.
     if (function_exists('clean_text')) {
         $message = clean_text($message);

@@ -118,4 +118,28 @@ public function test_is_web_crawler() {
             $this->assertTrue(is_web_crawler(), "$agent should be considered a search engine");
         }
     }
+
+    /**
+     * Test if get_exception_info() removes file system paths
+     */
+    public function test_exception_info_removes_serverpaths() {
+        global $CFG;
+
+        // This doesn't test them all possible ones, but these are set for unit tests.
+        $cfgnames = array('dataroot', 'dirroot', 'tempdir', 'cachedir');
+
+        $fixture  = '';
+        $expected = '';
+        foreach ($cfgnames as $cfgname) {
+            if (!empty($CFG->$cfgname)) {
+                $fixture  .= $CFG->$cfgname.' ';
+                $expected .= "[$cfgname] ";
+            }
+        }
+        $exception     = new moodle_exception('generalexceptionmessage', 'error', '', $fixture, $fixture);
+        $exceptioninfo = get_exception_info($exception);
+
+        $this->assertContains($expected, $exceptioninfo->message, 'Exception message does not contain system paths');
+        $this->assertContains($expected, $exceptioninfo->debuginfo, 'Exception debug info does not contain system paths');
+    }
 }

@@ -478,6 +478,22 @@ function get_exception_info($ex) {
         $message = $module . '/' . $errorcode;
     }
 
+    // Remove some absolute paths from message and debugging info.
+    $searches = array();
+    $replaces = array();
+    $cfgnames = array('tempdir', 'cachedir', 'themedir',
+        'langmenucachefile', 'langcacheroot', 'dataroot', 'dirroot');
+    foreach ($cfgnames as $cfgname) {
+        if (property_exists($CFG, $cfgname)) {
+            $searches[] = $CFG->$cfgname;
+            $replaces[] = "[$cfgname]";
+        }
+    }
+    if (!empty($searches)) {
+        $message   = str_replace($searches, $replaces, $message);
+        $debuginfo = str_replace($searches, $replaces, $debuginfo);
+    }
+
     // Be careful, no guarantee weblib.php is loaded.
     if (function_exists('clean_text')) {
         $message = clean_text($message);

@@ -526,6 +526,22 @@ function get_exception_info($ex) {
         $debuginfo .= PHP_EOL.'$a contents: '.print_r($a, true);
     }
 
+    // Remove some absolute paths from message and debugging info.
+    $searches = array();
+    $replaces = array();
+    $cfgnames = array('tempdir', 'cachedir', 'themedir',
+        'langmenucachefile', 'langcacheroot', 'dataroot', 'dirroot');
+    foreach ($cfgnames as $cfgname) {
+        if (property_exists($CFG, $cfgname)) {
+            $searches[] = $CFG->$cfgname;
+            $replaces[] = "[$cfgname]";
+        }
+    }
+    if (!empty($searches)) {
+        $message   = str_replace($searches, $replaces, $message);
+        $debuginfo = str_replace($searches, $replaces, $debuginfo);
+    }
+
     // Be careful, no guarantee weblib.php is loaded.
     if (function_exists('clean_text')) {
         $message = clean_text($message);

@@ -118,4 +118,28 @@ public function test_is_web_crawler() {
             $this->assertTrue(is_web_crawler(), "$agent should be considered a search engine");
         }
     }
+
+    /**
+     * Test if get_exception_info() removes file system paths
+     */
+    public function test_exception_info_removes_serverpaths() {
+        global $CFG;
+
+        // This doesn't test them all possible ones, but these are set for unit tests.
+        $cfgnames = array('dataroot', 'dirroot', 'tempdir', 'cachedir');
+
+        $fixture  = '';
+        $expected = '';
+        foreach ($cfgnames as $cfgname) {
+            if (!empty($CFG->$cfgname)) {
+                $fixture  .= $CFG->$cfgname.' ';
+                $expected .= "[$cfgname] ";
+            }
+        }
+        $exception     = new moodle_exception('generalexceptionmessage', 'error', '', $fixture, $fixture);
+        $exceptioninfo = get_exception_info($exception);
+
+        $this->assertContains($expected, $exceptioninfo->message, 'Exception message does not contain system paths');
+        $this->assertContains($expected, $exceptioninfo->debuginfo, 'Exception debug info does not contain system paths');
+    }
 }