From 6aad6d37baa97bb1656c9b6f02fe93d899c4edc4 Mon Sep 17 00:00:00 2001
From: Waleed Hassan <waleed.hassan@catalyst-eu.net>
Date: Sun, 12 Jul 2026 22:15:41 +0100
Subject: [PATCH] WR #490867 auth_outage Review changes - sanitise header
 metadata and file request parameters, restrict served mime types, guard
 warning bar css output, move svgicons config change out of constructor, add
 missing form field types

---
 classes/form/outage/edit.php                  |  2 ++
 classes/local/controllers/infopage.php        | 13 ++++++-----
 .../controllers/maintenance_static_page.php   |  3 ++-
 file.php                                      | 23 ++++++++++++++++---
 views/warningbar/warningbar.php               |  2 +-
 5 files changed, 32 insertions(+), 11 deletions(-)

diff --git a/classes/form/outage/edit.php b/classes/form/outage/edit.php
index 20be069..d54a9df 100644
--- a/classes/form/outage/edit.php
+++ b/classes/form/outage/edit.php
@@ -67,6 +67,7 @@ class edit extends moodleform {
         $mform->addHelpButton('title', 'title', 'auth_outage');
 
         $mform->addElement('editor', 'description', get_string('description', 'auth_outage'));
+        $mform->setType('description[text]', PARAM_RAW);
         $mform->addHelpButton('description', 'description', 'auth_outage');
 
         $mform->addElement('static', 'usagehints', '', get_string('textplaceholdershint', 'auth_outage'));
@@ -79,6 +80,7 @@ class edit extends moodleform {
             get_string('useaccesskey:desc', 'auth_outage'),
             0
         );
+        $mform->setType('useaccesskey', PARAM_BOOL);
 
         $mform->addElement('text', 'accesskey', get_string('accesskey', 'auth_outage'));
         $mform->setType('accesskey', PARAM_TEXT);
diff --git a/classes/local/controllers/infopage.php b/classes/local/controllers/infopage.php
index acfe126..7800ecf 100644
--- a/classes/local/controllers/infopage.php
+++ b/classes/local/controllers/infopage.php
@@ -47,11 +47,6 @@ class infopage {
      * @param array|null $params Parameters to use or null to get from Moodle API (request).
      */
     public function __construct(?array $params = null) {
-        global $CFG;
-        // Enable SVG support here to make sure all SVG files
-        // used in the current theme are served properly.
-        $CFG->svgicons = true;
-
         if (is_null($params)) {
             $params = [
                 'id' => optional_param('id', null, PARAM_INT),
@@ -92,6 +87,10 @@ class infopage {
      */
     public function output() {
         global $PAGE, $CFG, $OUTPUT;
+        // Enable SVG support here to make sure all SVG files
+        // used in the current theme are served properly.
+        $previoussvg = $CFG->svgicons ?? null;
+        $CFG->svgicons = true;
 
         if (is_null($this->outage)) {
             redirect(new moodle_url('/'));
@@ -111,7 +110,8 @@ class infopage {
 
         // Inject metadata into the header before output.
         if (!empty($this->outage->metadata)) {
-            header('X-Outage-Metadata: ' . $this->outage->metadata);
+            $safemeta = str_replace(["\r", "\n"], '', $this->outage->metadata);
+            header('X-Outage-Metadata: ' . $safemeta);
             header('X-Outage-StartTime: ' . $this->outage->starttime);
             header('X-Outage-EndTime: ' . $this->outage->stoptime);
         }
@@ -127,6 +127,7 @@ class infopage {
         if (!($CFG->branch == '27' && CLI_SCRIPT)) {
             echo $OUTPUT->footer();
         }
+        $CFG->svgicons = $previoussvg;
     }
 
     /**
diff --git a/classes/local/controllers/maintenance_static_page.php b/classes/local/controllers/maintenance_static_page.php
index 4a6896d..8536771 100644
--- a/classes/local/controllers/maintenance_static_page.php
+++ b/classes/local/controllers/maintenance_static_page.php
@@ -51,7 +51,8 @@ class maintenance_static_page {
         } else {
             // Inject metadata into the header before output.
             if (!empty($outage->metadata)) {
-                header('X-Outage-Metadata: ' . $outage->metadata);
+                $safemeta = str_replace(["\r", "\n"], '', $outage->metadata);
+                header('X-Outage-Metadata: ' . $safemeta);
                 header('X-Outage-StartTime: ' . $outage->starttime);
                 header('X-Outage-EndTime: ' . $outage->stoptime);
             }
diff --git a/file.php b/file.php
index 0281e98..396e5a8 100644
--- a/file.php
+++ b/file.php
@@ -37,14 +37,31 @@ if (!isset($_GET['file'])) {
     die('Missing file parameter.');
 }
 
-$parts = explode('.', $_GET['file']);
+$rawfile = $_GET['file'];
+if (!preg_match('/^[a-zA-Z0-9_\-\.\/]+$/', $rawfile)) {
+    http_response_code(400);
+    die('Invalid file parameter.');
+}
+
+$parts = explode('.', $rawfile);
 if (count($parts) != 2) {
     http_response_code(400);
     die('Invalid file requested.');
 }
-$mime = base64_decode($parts[1]);
+$extension = strtolower(pathinfo($parts[0], PATHINFO_EXTENSION));
+$allowedmimes = [
+    'css'  => 'text/css',
+    'png'  => 'image/png',
+    'jpg'  => 'image/jpeg',
+    'jpeg' => 'image/jpeg',
+    'gif'  => 'image/gif',
+];
+if (!array_key_exists($extension, $allowedmimes)) {
+    http_response_code(400);
+    die('Unsupported file type.');
+}
+$mime = $allowedmimes[$extension];
 
-// Detect type, we only support css or PNG images.
 header('Content-Type: ' . $mime);
 
 // Use cache.
diff --git a/views/warningbar/warningbar.php b/views/warningbar/warningbar.php
index c6ea9ea..edaecc0 100644
--- a/views/warningbar/warningbar.php
+++ b/views/warningbar/warningbar.php
@@ -68,7 +68,7 @@ if (!$viewbag['static']) {
     <style>
         <?php
             readfile($CFG->dirroot . '/auth/outage/views/warningbar/warningbar.css');
-            echo outagelib::get_config()->css;
+            echo preg_replace('/<\s*\/\s*style\s*>/i', '', outagelib::get_config()->css);
         ?>
     </style>