Added some cleaning to the category path for some safety.

diff --git a/lib/questionlib.php b/lib/questionlib.php
index 5fc06213455da6550debe5c710583ece8eb310aa..ff387252b05b48a7f9dfcc1d06c80dc82249e9ea 100644 (file)
--- a/lib/questionlib.php
+++ b/lib/questionlib.php
@@ -1603,6 +1603,7 @@ function question_categorylist($categoryid) {
  * @return mixed category object or null if fails
  */
 function create_category_path( $catpath, $delimiter='/', $courseid=0 ) {
+       $catpath = clean_param( $catpath,PARAM_PATH ); 
     $catnames = explode( $delimiter, $catpath );
     $parent = 0;
     $category = null;