Bypass Reference Validation

Moodle is vulnerable to bypass reference validation. The function filesavedraftareafiles at server side does not check permission of file shortcuts/aliases while uploading/saving a file from a draft file to the server. Therefore, any authenticated users can bypass the intended alias restrictions...