CVE-2021-44662: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A Site Scripting (XSS) vulnerability exists in the Xerte Project Xerte through 3.8.4 via the link parameter in print.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-02-24T19:15Z
Repository: https://github.com/thexerteproject/xerteonlinetoolkits
Language: Other
Files changed: USER-FILES/.htaccess, editor/elfinder/browse.php, editor/elfinder/php/connector.php, editor/elfinder/php/elFinderVolumeDriver.class.php, editor/elfinder/php/mime.types, error_logs/.htaccess, import/.htaccess, languages/.htaccess, modules/decision/templates/decision/.htaccess, modules/site/templates/site/.htaccess, modules/xerte/templates/FutureTeacher/.htaccess, modules/xerte/templates/Nottingham/.htaccess, modules/xerte/templates/Rss/.htaccess, modules/xerte/templates/mediaInteractions/.htaccess, modules/xerte/templates/multipersp/.htaccess, plugins/file_uploading-extension-check.php, print/index.php, print/print.php, setup/htaccess.conf, website_code/php/import/fileupload.php, website_code/php/management/upload.php
Commit date: 2020-03-27 13:13:00 +0100
Commit message: Security patch - Thank you Rik Lutz

 - Fixed and stopped possibility to upload constructed php files throgh
   elfinder
 - Added .htaccess files to try to tighten security on apache servers
 - Always use extension blacklist (ignore management page setting)
 - Stop XSS in print
 - Several other small improvements

Diff: diff --git a/USER-FILES/.htaccess b/USER-FILES/.htaccess
index 377fcc44..de96ce0c 100644
--- a/USER-FILES/.htaccess
+++ b/USER-FILES/.htaccess
@@ -3,9 +3,10 @@ Options -Indexes
 
 
 # Try and tell Apache not to serve out any files within this directory as PHP - 
 # this helps close a potential security flaw - given people can upload almost anything into an LO.
 
-#RemoveHandler .php
-<FilesMatch "\.((php[0-9]?)|p?html?|pl|sh|java|cpp|c|h|js|rc)$">
-    SetHandler None
-</FilesMatch>
+#prevent execution of php code (and other code)
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
+</IfModule>
\ No newline at end of file
diff --git a/editor/elfinder/browse.php b/editor/elfinder/browse.php
index 9cf3632e..03fbf35b 100644
--- a/editor/elfinder/browse.php
+++ b/editor/elfinder/browse.php
@@ -20,10 +20,43 @@
 
 /**
  * Created by Tom Reijnders
  */
 
+require_once "../../config.php";
+
+if(empty($_SESSION['toolkits_logon_id'])) {
+    die("Please login");
+}
+
+// if there are GET paramters, put them in session and restart
+if (isset($_GET['uploadDir']) && isset($_GET['uploadURL']))
+{
+    $_SESSION['uploadDir'] = $_REQUEST['uploadDir'];
+    $_SESSION['uploadURL'] = $_REQUEST['uploadURL'];
+
+    $params = "?";
+    foreach($_GET as $key => $param)
+    {
+        if ($key != "uploadDir" && $key != "uploadURL")
+        {
+            if (strlen($params) > 1)
+            {
+                $params .= "&";
+            }
+            $params .= $key . "=" . $param;
+        }
+    }
+
+    header("Location: " . $_SERVER["SCRIPT_NAME"] . $params);
+}
+
+if (strpos($_SESSION['uploadDir'], 'USER-FILES') === false || strpos($_SESSION['uploadURL'], 'USER-FILES') === false)
+{
+    die("Invalid upload location");
+}
+
 $mode = 'standalone';
 if (isset($_REQUEST['mode']) && $_REQUEST['mode']=='cke') {
     $mode = 'cke';
     $funcNum = $_REQUEST['CKEditorFuncNum'];
 }
@@ -86,11 +119,11 @@ if (isset($_REQUEST['langCode']))
                 echo "var funcNum = $funcNum;";
             }
             ?>
 
             $('#elfinder').elfinder({
-                url : 'php/connector.php?uploadDir=<?php echo $_REQUEST['uploadDir'];?>&uploadURL=<?php echo $_REQUEST['uploadURL'];?>',       // connector URL (REQUIRED)
+                url : 'php/connector.php?uploadDir=<?php echo $_SESSION['uploadDir'];?>&uploadURL=<?php echo $_SESSION['uploadURL'];?>',       // connector URL (REQUIRED)
                 lang: '<?php echo $lang;?>',     // language (OPTIONAL)
                 uiOptions : {
                     // toolbar configuration
                     toolbar : [
                         // ['back', 'forward'],
diff --git a/editor/elfinder/php/connector.php b/editor/elfinder/php/connector.php
index 03dde7ea..617b4127 100644
--- a/editor/elfinder/php/connector.php
+++ b/editor/elfinder/php/connector.php
@@ -88,14 +88,14 @@ $opts = array(
 		array(
 			'driver'        => 'LocalFileSystem',   // driver for accessing file system (REQUIRED)
 			'path'          => $rootpath . "/media",         // path to files (REQUIRED)
 			'URL'           => $rooturl . "/media", // URL to files (REQUIRED)
 			'accessControl' => 'access',             // disable and hide dot starting files (OPTIONAL)
-            'tmbPath'       => $rootpath . "/media//.tmb",
+            'tmbPath'       => $rootpath . "/media/.tmb",
             'tmbURL'        => $rooturl . "/media/.tmb",
             'tmbCrop'       => false,
-            'uploadDeny' => array('text/x-php'),
+            'uploadDeny' => array('text/x-php','application/x-php'),
             'attributes' => array(
                 array( // hide readmes
                     'pattern' => '/\.(txt|html|php|php5|php*|py|pl|sh|xml)$/i',
                     'read'   => false,
                     'write'  => false,
diff --git a/editor/elfinder/php/elFinderVolumeDriver.class.php b/editor/elfinder/php/elFinderVolumeDriver.class.php
index c57222df..2946c63e 100644
--- a/editor/elfinder/php/elFinderVolumeDriver.class.php
+++ b/editor/elfinder/php/elFinderVolumeDriver.class.php
@@ -2191,10 +2191,14 @@ abstract class elFinderVolumeDriver {
 				}
 				$ext = (false === $pos = strrpos($name, '.')) ? '' : substr($name, $pos + 1);
 				if ($ext && preg_match('~^application/(?:octet-stream|(?:x-)?zip)~', $type)) {
 					if (isset(elFinderVolumeDriver::$mimetypes[$ext])) $type = elFinderVolumeDriver::$mimetypes[$ext];
 				}
+				if ($ext && strpos($type, "text/plain") === 0)
+                {
+                    if (isset(elFinderVolumeDriver::$mimetypes[$ext])) $type = elFinderVolumeDriver::$mimetypes[$ext];
+                }
 			}
 		} elseif ($type == 'mime_content_type') {
 			$type = mime_content_type($path);
 		} else {
 			$type = elFinderVolumeDriver::mimetypeInternalDetect($path);
diff --git a/editor/elfinder/php/mime.types b/editor/elfinder/php/mime.types
index a3c4f1c0..2c656a06 100644
--- a/editor/elfinder/php/mime.types
+++ b/editor/elfinder/php/mime.types
@@ -225,11 +225,11 @@ application/x-oleo oleo
 application/x-palm-database
 application/x-palm-database pdb prc
 application/x-par2 PAR2 par2
 application/x-pef-executable
 application/x-perl pl pm al perl
-application/x-php php php3 php4
+application/x-php php php3 php4 php5
 application/x-pkcs12 p12 pfx
 application/x-planner planner mrproject
 application/x-planperfect pln
 application/x-prjx prjx
 application/x-profile
diff --git a/error_logs/.htaccess b/error_logs/.htaccess
new file mode 100644
index 00000000..4301fd0e
--- /dev/null
+++ b/error_logs/.htaccess
@@ -0,0 +1,12 @@
+# Stop Apache doing directory indexing.
+Options -Indexes 
+
+
+# Try and tell Apache not to serve out any files within this directory as PHP - 
+# this helps close a potential security flaw - given people can upload almost anything into an LO.
+
+#prevent execution of php code (and other code)
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py|log)$ - [F]
+</IfModule>
\ No newline at end of file
diff --git a/import/.htaccess b/import/.htaccess
new file mode 100644
index 00000000..de96ce0c
--- /dev/null
+++ b/import/.htaccess
@@ -0,0 +1,12 @@
+# Stop Apache doing directory indexing.
+Options -Indexes 
+
+
+# Try and tell Apache not to serve out any files within this directory as PHP - 
+# this helps close a potential security flaw - given people can upload almost anything into an LO.
+
+#prevent execution of php code (and other code)
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
+</IfModule>
\ No newline at end of file
diff --git a/languages/.htaccess b/languages/.htaccess
new file mode 100644
index 00000000..de96ce0c
--- /dev/null
+++ b/languages/.htaccess
@@ -0,0 +1,12 @@
+# Stop Apache doing directory indexing.
+Options -Indexes 
+
+
+# Try and tell Apache not to serve out any files within this directory as PHP - 
+# this helps close a potential security flaw - given people can upload almost anything into an LO.
+
+#prevent execution of php code (and other code)
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
+</IfModule>
\ No newline at end of file
diff --git a/modules/decision/templates/decision/.htaccess b/modules/decision/templates/decision/.htaccess
new file mode 100644
index 00000000..de96ce0c
--- /dev/null
+++ b/modules/decision/templates/decision/.htaccess
@@ -0,0 +1,12 @@
+# Stop Apache doing directory indexing.
+Options -Indexes 
+
+
+# Try and tell Apache not to serve out any files within this directory as PHP - 
+# this helps close a potential security flaw - given people can upload almost anything into an LO.
+
+#prevent execution of php code (and other code)
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
+</IfModule>
\ No newline at end of file
diff --git a/modules/site/templates/site/.htaccess b/modules/site/templates/site/.htaccess
new file mode 100644
index 00000000..de96ce0c
--- /dev/null
+++ b/modules/site/templates/site/.htaccess
@@ -0,0 +1,12 @@
+# Stop Apache doing directory indexing.
+Options -Indexes 
+
+
+# Try and tell Apache not to serve out any files within this directory as PHP - 
+# this helps close a potential security flaw - given people can upload almost anything into an LO.
+
+#prevent execution of php code (and other code)
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
+</IfModule>
\ No newline at end of file
diff --git a/modules/xerte/templates/FutureTeacher/.htaccess b/modules/xerte/templates/FutureTeacher/.htaccess
new file mode 100644
index 00000000..de96ce0c
--- /dev/null
+++ b/modules/xerte/templates/FutureTeacher/.htaccess
@@ -0,0 +1,12 @@
+# Stop Apache doing directory indexing.
+Options -Indexes 
+
+
+# Try and tell Apache not to serve out any files within this directory as PHP - 
+# this helps close a potential security flaw - given people can upload almost anything into an LO.
+
+#prevent execution of php code (and other code)
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
+</IfModule>
\ No newline at end of file
diff --git a/modules/xerte/templates/Nottingham/.htaccess b/modules/xerte/templates/Nottingham/.htaccess
new file mode 100644
index 00000000..de96ce0c
--- /dev/null
+++ b/modules/xerte/templates/Nottingham/.htaccess
@@ -0,0 +1,12 @@
+# Stop Apache doing directory indexing.
+Options -Indexes 
+
+
+# Try and tell Apache not to serve out any files within this directory as PHP - 
+# this helps close a potential security flaw - given people can upload almost anything into an LO.
+
+#prevent execution of php code (and other code)
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
+</IfModule>
\ No newline at end of file
diff --git a/modules/xerte/templates/Rss/.htaccess b/modules/xerte/templates/Rss/.htaccess
new file mode 100644
index 00000000..de96ce0c
--- /dev/null
+++ b/modules/xerte/templates/Rss/.htaccess
@@ -0,0 +1,12 @@
+# Stop Apache doing directory indexing.
+Options -Indexes 
+
+
+# Try and tell Apache not to serve out any files within this directory as PHP - 
+# this helps close a potential security flaw - given people can upload almost anything into an LO.
+
+#prevent execution of php code (and other code)
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
+</IfModule>
\ No newline at end of file
diff --git a/modules/xerte/templates/mediaInteractions/.htaccess b/modules/xerte/templates/mediaInteractions/.htaccess
new file mode 100644
index 00000000..de96ce0c
--- /dev/null
+++ b/modules/xerte/templates/mediaInteractions/.htaccess
@@ -0,0 +1,12 @@
+# Stop Apache doing directory indexing.
+Options -Indexes 
+
+
+# Try and tell Apache not to serve out any files within this directory as PHP - 
+# this helps close a potential security flaw - given people can upload almost anything into an LO.
+
+#prevent execution of php code (and other code)
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
+</IfModule>
\ No newline at end of file
diff --git a/modules/xerte/templates/multipersp/.htaccess b/modules/xerte/templates/multipersp/.htaccess
new file mode 100644
index 00000000..de96ce0c
--- /dev/null
+++ b/modules/xerte/templates/multipersp/.htaccess
@@ -0,0 +1,12 @@
+# Stop Apache doing directory indexing.
+Options -Indexes 
+
+
+# Try and tell Apache not to serve out any files within this directory as PHP - 
+# this helps close a potential security flaw - given people can upload almost anything into an LO.
+
+#prevent execution of php code (and other code)
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
+</IfModule>
\ No newline at end of file
diff --git a/plugins/file_uploading-extension-check.php b/plugins/file_uploading-extension-check.php
index b291e727..ee449ea2 100644
--- a/plugins/file_uploading-extension-check.php
+++ b/plugins/file_uploading-extension-check.php
@@ -82,9 +82,12 @@ function filter_by_extension_name() {
     } 
 
     return $args[0];
 }
 
-if (Xerte_Validate_FileExtension::canRun() && $xerte_toolkits_site->enable_file_ext_check) {
+// TOR 2020-03-24
+// Force extension check, so DO NOT CHECK $xerte_toolkits_site->enable_file_ext_check
+//if (Xerte_Validate_FileExtension::canRun() && $xerte_toolkits_site->enable_file_ext_check) {
+if (Xerte_Validate_FileExtension::canRun()) {
     Xerte_Validate_FileExtension::$BLACKLIST = $xerte_toolkits_site->file_extensions;
     add_filter('editor_upload_file', 'filter_by_extension_name');
 }
diff --git a/print/index.php b/print/index.php
index fe370234..4f7af150 100644
--- a/print/index.php
+++ b/print/index.php
@@ -33,12 +33,12 @@ body {
     <h1> Print your Xerte LO</h1>
     <p>Note: This is just a test and demo of how we could enable printing of Xerte LO's without major changes to the existing code. Longer term we would ideally add a more elegant solution and perhaps saving as pdf and epub too. Your LO must be public for this to work.</p>
     <form id="form1" name="form1" method="get" action="print.php">
       <p>To see how this works use the example below or paste the full link to your own LO.</p>
       <p>
-        <label>Link to LO:
-          <input name="link" type="text" id="link" value="http://training.mitchellmedia.co.uk/xerte/play.php?template_id=96" size="100" />
+        <label>The template id of the LO, :
+          <input name="template_id" type="text" id="template_id" value="" size="80" />
         </label>
       </p>
       <p>Print LO pages: 
         <label>from
           <input name="from" type="text" id="from" value="1" size="8" />
diff --git a/print/print.php b/print/print.php
index 9a635ffd..226325e6 100644
--- a/print/print.php
+++ b/print/print.php
@@ -1,5 +1,8 @@
+<?php
+require_once("../config.php");
+?>
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
 <title>Print your LO results</title>
@@ -28,16 +31,18 @@ body {
 
 <body class="oneColElsCtr">
 
 <div id="container">
   <div id="mainContent">
-    <h1><?php 
+    <p><?php
 	$hide=$_GET["hide"];
-	$link=$_GET["link"];
+	$template_id=$_GET["template_id"];
 	$from=$_GET["from"];
 	$to=$_GET["to"];
-	
+
+	// Create the link
+    $link = $xerte_toolkits_site->site_url . "play.php?template_id=" . $template_id;
 	#echo $link."<br>";
 while($from <= $to)
   {
 	   echo "<iframe src='".$link."&display=fill&hide=bottom&page=$from&hide=$hide' width=810 height=610 frameBorder=0></iframe><br /><br />";
 	  $from++;
diff --git a/setup/htaccess.conf b/setup/htaccess.conf
index 88113091..70412352 100644
--- a/setup/htaccess.conf
+++ b/setup/htaccess.conf
@@ -1,6 +1,6 @@
-Options +FollowSymLinks
+Options +FollowSymLinks -Indexes
 
 rewriteEngine on
 
 rewriteBase /
 
diff --git a/website_code/php/import/fileupload.php b/website_code/php/import/fileupload.php
index ca65c0ab..8b23949a 100644
--- a/website_code/php/import/fileupload.php
+++ b/website_code/php/import/fileupload.php
@@ -18,10 +18,16 @@
  * limitations under the License.
  */
 require_once "../../../config.php";
 require_once "../../../plugins.php";
 
+if (!isset($_SESSION['toolkits_logon_username']))
+{
+    _debug("Session is invalid or expired");
+    die("Session is invalid or expired");
+}
+
 _load_language_file("/website_code/php/import/fileupload.inc");
 
 if(apply_filters('editor_upload_file', $_FILES)){
 
     if($_FILES['filenameuploaded']['type']=="text/html"){
diff --git a/website_code/php/management/upload.php b/website_code/php/management/upload.php
index 708281ab..41a08800 100644
--- a/website_code/php/management/upload.php
+++ b/website_code/php/management/upload.php
@@ -15,10 +15,16 @@ require_once("../../../config.php");
 _load_language_file("/website_code/php/management/upload.inc");
 
 global $xerte_toolkits_site;
 $prefix = $xerte_toolkits_site->database_table_prefix;
 
+if (!isset($_SESSION['toolkits_logon_username']))
+{
+    _debug("Session is invalid or expired");
+    die("Session is invalid or expired");
+}
+
 if($_FILES['fileToUpload']['error'] == 4)
 {
     exit(TEMPLATE_UPLOAD_NO_FILE_SELECTED);
 }
 

Vulnerable code: #RemoveHandler .php
<FilesMatch "\.((php[0-9]?)|p?html?|pl|sh|java|cpp|c|h|js|rc)$">
    SetHandler None
</FilesMatch>
                url : 'php/connector.php?uploadDir=<?php echo $_REQUEST['uploadDir'];?>&uploadURL=<?php echo $_REQUEST['uploadURL'];?>',       // connector URL (REQUIRED)
            'tmbPath'       => $rootpath . "/media//.tmb",
            'uploadDeny' => array('text/x-php'),
application/x-php php php3 php4
if (Xerte_Validate_FileExtension::canRun() && $xerte_toolkits_site->enable_file_ext_check) {
        <label>Link to LO:
          <input name="link" type="text" id="link" value="http://training.mitchellmedia.co.uk/xerte/play.php?template_id=96" size="100" />
    <h1><?php 
	$link=$_GET["link"];
	
Options +FollowSymLinks
Fixed code: #prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
require_once "../../config.php";

if(empty($_SESSION['toolkits_logon_id'])) {
    die("Please login");
}

// if there are GET paramters, put them in session and restart
if (isset($_GET['uploadDir']) && isset($_GET['uploadURL']))
{
    $_SESSION['uploadDir'] = $_REQUEST['uploadDir'];
    $_SESSION['uploadURL'] = $_REQUEST['uploadURL'];

    $params = "?";
    foreach($_GET as $key => $param)
    {
        if ($key != "uploadDir" && $key != "uploadURL")
        {
            if (strlen($params) > 1)
            {
                $params .= "&";
            }
            $params .= $key . "=" . $param;
        }
    }

    header("Location: " . $_SERVER["SCRIPT_NAME"] . $params);
}

if (strpos($_SESSION['uploadDir'], 'USER-FILES') === false || strpos($_SESSION['uploadURL'], 'USER-FILES') === false)
{
    die("Invalid upload location");
}

                url : 'php/connector.php?uploadDir=<?php echo $_SESSION['uploadDir'];?>&uploadURL=<?php echo $_SESSION['uploadURL'];?>',       // connector URL (REQUIRED)
            'tmbPath'       => $rootpath . "/media/.tmb",
            'uploadDeny' => array('text/x-php','application/x-php'),
				if ($ext && strpos($type, "text/plain") === 0)
                {
                    if (isset(elFinderVolumeDriver::$mimetypes[$ext])) $type = elFinderVolumeDriver::$mimetypes[$ext];
                }
application/x-php php php3 php4 php5
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py|log)$ - [F]
</IfModule>
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
// TOR 2020-03-24
// Force extension check, so DO NOT CHECK $xerte_toolkits_site->enable_file_ext_check
//if (Xerte_Validate_FileExtension::canRun() && $xerte_toolkits_site->enable_file_ext_check) {
if (Xerte_Validate_FileExtension::canRun()) {
        <label>The template id of the LO, :
          <input name="template_id" type="text" id="template_id" value="" size="80" />
<?php
require_once("../config.php");
?>
    <p><?php
	$template_id=$_GET["template_id"];

	// Create the link
    $link = $xerte_toolkits_site->site_url . "play.php?template_id=" . $template_id;
Options +FollowSymLinks -Indexes
if (!isset($_SESSION['toolkits_logon_username']))
{
    _debug("Session is invalid or expired");
    die("Session is invalid or expired");
}

if (!isset($_SESSION['toolkits_logon_username']))
{
    _debug("Session is invalid or expired");
    die("Session is invalid or expired");
}