Mihail Geshoski authored Nov 27, 2020 and Jake Dallimore committed Jan 13, 2021

Prevents configuring the 'Data modification API' (convert_data) setting
to use files located within the $CFG->dataroot directory as it exposes
the site to security risks.