[Security] Correct occurrences of (needle,haystack) to (haystack,needle) in strpos file validation

[johnsaigle]

This pull request fixes several errors where code used to prevent path traversal was incorrectly using needle-haystack syntax instead of haystack-needle for the strpos function.

In order to prevent this occurring in the future, I strongly suggest that we merge #2918 and use the resolvePath() function for the prevention of path traversal. However, this PR addresses the immediate problem and should provide some hardening until the 2918 is merged and can be applied throughout the codebase.

The below changes were made based on executing grep -nr "strpos(\".." . in the LORIS root and modifying each of the results (excluding the .vendor results).

Broken access control has been tested and confirmed on GetStatic.php, GetJs.php and data_release.

See also:

• [Core] Fixing full file system access security vulnerability #2950 which addresses the same error in GetStatic.php and inspired this PR
• strpos syntax
• [Libraries] Move resolvePath function to the Utility class #2918 for a more robust was of preventing path traversal

[driusan]

There's 5 commits unrelated to this change in the PR, can you fix the branch to only have the relevant commits?

[johnsaigle]

@driusan
Yep will do so this afternoon

[johnsaigle]

@driusan The extraneous commits were removed. Could you update your review?

was fixed

[Jkat]

This and #2948 can be merged