Merged pathname checking from stable

diff --git a/mod/quiz/report.php b/mod/quiz/report.php
index 84ed58b96decb69cf627812cc20783de7ae5041a..e13c1c5bbfa8298779f25f34ea2af52ed6b37fa6 100644 (file)
--- a/mod/quiz/report.php
+++ b/mod/quiz/report.php
@@ -84,8 +84,10 @@
 
 /// Open the selected quiz report and display it
 
+    $mode = clean_filename($mode);
+
     if (! is_readable("report/$mode/report.php")) {
-        error("Report not known ($mode)");
+        error("Report not known (".clean_text($mode).")");
     }
 
     include("report/default.php");  // Parent class