filename is the 5th parameter. Now it's cleaned and used

by the send_file() function.
eSrem · Dec 14, 2004 · be88433 · be88433
1 parent fa6ed70
commit be88433
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/rss/file.php b/rss/file.php
@@ -31,14 +31,15 @@
     // extract relative path components
     $args = explode('/', trim($relativepath, '/'));
 
-    if (count($args) < 4) {
+    if (count($args) < 5) {
         not_found();
     }
 
     $courseid   = (int)$args[0];
     $userid     = (int)$args[1];
     $modulename = clean_param($args[2], PARAM_FILE);
     $instance   = (int)$args[3];
+    $filename   = clean_param($args[4], PARAM_FILE);
 
     if (!$course = get_record("course", "id", $courseid)) {
         not_found();
@@ -68,7 +69,6 @@
         not_found();
     }
 
-    $filename = $instance.'.xml';
     $pathname = $CFG->dataroot.'/rss/'.$modulename.'/'.$filename;
 
     //Check that file exists
@@ -81,7 +81,7 @@
 
     function not_found() {
         /// error, send some XML with error message
-        global $lifetime;
-        send_file(rss_geterrorxmlfile(), 'rsserror.xml', $lifetime, false, true);
+        global $lifetime, $filename;
+        send_file(rss_geterrorxmlfile(), $filename, $lifetime, false, true);
     }
 ?>