CVE-2024-34003: Local file inclusion via modified workshop backups in Moodle

In a workshop, participants assess each other. The grading strategy, a rubric for example, defines how they assess. The evaluation method defines how the assessments turn into a grade at the end. Both are subplugins with their own subdirectory.

Moodle loads the code of the selected subplugin by its stored name. After a restore, strategy and evaluation came straight from the backup file and so became part of the path of the file to include.

Reported by Vincent Schneider through the Moodle security process, published as MSA-24-0014.

On a properly set up installation the restore permission alone is not enough. It also takes direct access to the server file system outside Moodle, the kind a badly separated shared hosting can give to other customers.

When both apply, Moodle runs foreign PHP code as soon as the workshop loads its strategy or evaluation. The code has the same permissions as Moodle and can reach the site's database and file storage.

clean_param() now limits both values to valid plugin names: on restore, when the activity is loaded and when the evaluation method is set. An empty strategy ends in an error before Moodle looks for any file.