WR490987: Fix issues identified by security audit.

classes/cache_administration_helper.php

@@ -148,7 +148,7 @@ private function generate_store_table(string $name, array $config): string {
         ];
         $table->data = [];
         foreach ($config['config'] as $key => $value) {
-            $table->data[] = [$key, $value];
+            $table->data[] = [s($key), s($value)];
         }
         $html .= html_writer::table($table);
 
@@ -181,10 +181,10 @@ private function generate_override_table(array $overrides): string {
         foreach ($overrides as $definition => $items) {
             $itemstring = '';
             foreach ($items as $setting => $value) {
-                $itemstring .= "{$setting}: {$value} <br>";
+                $itemstring .= s($setting) . ": " . s($value);
             }
 
-            $table->data[] = [$definition, $itemstring];
+            $table->data[] = [s($definition), $itemstring];
         }
         $html .= html_writer::table($table);
 
@@ -234,7 +234,7 @@ private function generate_mode_table(int $mode, array $config): string {
                 // Little bit of string mangling.
                 $conditions = '';
                 foreach ($ruleset['conditions'] as $condition => $value) {
-                    $conditions .= $condition . ' = ' . $value . ', ';
+                    $conditions .= s($condition) . ' = ' . s($value) . ', ';
                 }
                 $conditions = rtrim($conditions, ', ');
             } else {
@@ -244,7 +244,7 @@ private function generate_mode_table(int $mode, array $config): string {
             $table->data[] = [
                 $counter,
                 $conditions,
-                implode(',', $ruleset['stores']),
+                s(implode(',', $ruleset['stores'])),
             ];
             $counter++;
         }

classes/cache_config.php

@@ -225,9 +225,18 @@ private function generate_store_instance_config(array $stores): array {
 
             // Now for the derived config from the store information provided.
             // Manually require the cache/lib.php file to get cache classes.
-            $cachepath = __DIR__ . '/../../../../cache/stores/' . $store['type'] . '/lib.php';
-            if (!file_exists($cachepath)) {
-                throw new cache_exception(get_string('store_bad_type', 'tool_forcedcache', $store['type']));
+            $cachepath = realpath(__DIR__ . '/../../../../cache/stores/' . basename($store['type']) . '/lib.php');
+            $expectedbase = realpath(__DIR__ . '/../../../../cache/stores/');
+
+            // Cache path with the supplied type must still be within the expected base, to avoid fs traversal.
+            if (
+                $cachepath === false ||
+                strpos($cachepath, $expectedbase) !== 0 ||
+                !file_exists($cachepath)
+            ) {
+                throw new cache_exception(
+                    get_string('store_bad_type', 'tool_forcedcache', $store['type'])
+                );
             }
             require_once($cachepath);
             $storearr['features'] = $classname::get_supported_features();

index.php

@@ -36,7 +36,6 @@
 $dummy = new tool_forcedcache_cache_config();
 $errors = $dummy->get_inclusion_errors();
 
-
 if (
     empty($CFG->alternative_cache_factory_class) ||
     $CFG->alternative_cache_factory_class !== 'tool_forcedcache_cache_factory' ||
@@ -49,7 +48,7 @@
 
 if (!empty($errors)) {
     echo html_writer::tag('h3', get_string('page_config_broken', 'tool_forcedcache'));
-    $error = html_writer::tag('pre', $errors);
+    $error = html_writer::tag('pre', s($errors));
     echo html_writer::tag('p', get_string('page_config_broken_details', 'tool_forcedcache', $error));
 } else {
     echo $OUTPUT->notification(get_string('page_config_ok', 'tool_forcedcache'), \core\output\notification::NOTIFY_SUCCESS);

version.php

@@ -24,7 +24,7 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$plugin->version   = 2025122400;
+$plugin->version   = 2025122401;
 $plugin->release   = 2025122400;
 $plugin->requires  = 2025100600; // Requires 5.1.
 $plugin->component = 'tool_forcedcache'; // Full name of the plugin (used for diagnostics).