1 files changed, 20 insertions, 15 deletions

diff --git a/engine/classes/ElggPlugin.php b/engine/classes/ElggPlugin.php
index 2fe29d175..3352105f8 100644
--- a/engine/classes/ElggPlugin.php
+++ b/engine/classes/ElggPlugin.php
@@ -131,7 +131,7 @@ class ElggPlugin extends ElggObject {
 	 * @return string
 	 */
 	public function getPath() {
-		return $this->path;
+		return sanitise_filepath($this->path);
 	}
 
 
@@ -179,20 +179,6 @@ class ElggPlugin extends ElggObject {
 		$old_priority = (int) $this->getPriority();
 		$max_priority = elgg_get_max_plugin_priority();
 
-		if ($priority == $old_priority) {
-			return false;
-		}
-
-		// there's nothing above the max.
-		if ($priority > $max_priority) {
-			$priority = $max_priority;
-		}
-
-		// there's nothing below 1.
-		if ($priority < 1) {
-			$priority = 1;
-		}
-
 		// (int) 0 matches (string) first, so cast to string.
 		$priority = (string) $priority;
 
@@ -220,6 +206,20 @@ class ElggPlugin extends ElggObject {
 				return false;
 			}
 
+			if ($priority == $old_priority) {
+				return false;
+			}
+
+			// there's nothing above the max.
+			if ($priority > $max_priority) {
+				$priority = $max_priority;
+			}
+
+			// there's nothing below 1.
+			if ($priority < 1) {
+				$priority = 1;
+			}
+
 			if ($priority > $old_priority) {
 				$op = '-';
 				$where = "CAST(value as unsigned) BETWEEN $old_priority AND $priority";
@@ -489,6 +489,11 @@ class ElggPlugin extends ElggObject {
 		if ($this->isActive($site_guid)) {
 			return false;
 		}
+
+		if (!$this->canActivate()) {
+			return false;
+		}
+
 		// set in the db, now perform tasks and emit events
 		if ($this->setStatus(true, $site_guid)) {
 			// emit an event. returning false will make this not be activated.