From 1c47adc54083c3a1b32247ca4bf50aa1e1d655f7 Mon Sep 17 00:00:00 2001
From: skodak <skodak>
Date: Mon, 6 Mar 2006 10:02:59 +0000
Subject: [PATCH] parameter cleaup - round 1

---
 admin/admin.php         |  6 +-----
 admin/auth.php          | 12 +++++-------
 admin/block.php         |  2 +-
 admin/blocks.php        |  2 +-
 admin/config.php        |  7 +++----
 admin/configvars.php    |  1 +
 admin/creators.html     |  2 +-
 admin/creators.php      |  7 ++-----
 admin/dbperformance.php |  8 ++++----
 admin/delete.php        |  4 ++--
 admin/editor.php        | 16 +++++++++-------
 admin/enrol.php         |  5 +++--
 admin/environment.php   |  5 ++---
 admin/filter.php        | 14 ++++++++------
 14 files changed, 43 insertions(+), 48 deletions(-)

diff --git a/admin/admin.php b/admin/admin.php
index 62da7ccc295..8744c0a6dda 100644
--- a/admin/admin.php
+++ b/admin/admin.php
@@ -1,14 +1,10 @@
 <?PHP // $Id$
       // Admin-only script to assign administrative rights to users
 
-    require_once("../config.php");
+    require_once('../config.php');
     
     define("MAX_USERS_PER_PAGE", 50);
 
-    $add = optional_param('add', "", PARAM_ALPHA);
-    $remove = optional_param('remove', '', PARAM_ALPHA);
-    $search = optional_param('search', '', PARAM_ALPHA);
-
     if (! $site = get_site()) {
         redirect("$CFG->wwwroot/$CFG->admin/index.php");
     }
diff --git a/admin/auth.php b/admin/auth.php
index cec3f69d6f3..7738bc39b4b 100644
--- a/admin/auth.php
+++ b/admin/auth.php
@@ -1,9 +1,9 @@
 <?PHP  // $Id$
        // config.php - allows admin to edit all configuration variables
 
-    include("../config.php");
+    require_once('../config.php');
 
-    $auth = optional_param( 'auth','',PARAM_CLEAN );
+    $auth = optional_param('auth', '', PARAM_SAFEDIR);
 
     require_login();
 
@@ -19,8 +19,9 @@
         error(get_string('confirmsesskeybad', 'error'));
     }
 
-/// If data submitted, then process and store.
+    $focus = '';
 
+/// If data submitted, then process and store.
 
     if ($config = data_submitted()) {
 
@@ -66,6 +67,7 @@
     }
 
     $modules = get_list_of_plugins("auth");
+    $options = array();
     foreach ($modules as $module) {
         $options[$module] = get_string("auth_$module"."title", "auth");
     }
@@ -105,10 +107,6 @@
     }
     $user_fields = array("firstname", "lastname", "email", "phone1", "phone2", "department", "address", "city", "country", "description", "idnumber", "lang");
 
-    if (empty($focus)) {
-        $focus = "";
-    }
-
     $guestoptions[0] = get_string("hide");
     $guestoptions[1] = get_string("show");
 
diff --git a/admin/block.php b/admin/block.php
index 2f831b2c597..37ce32105c1 100644
--- a/admin/block.php
+++ b/admin/block.php
@@ -14,7 +14,7 @@
         error("Site isn't defined!");
     }
 
-    $blockid = required_param( 'block',PARAM_INT );
+    $blockid = required_param('block', PARAM_INT);
    
     if(($blockrecord = blocks_get_record($blockid)) === false) {
         error('This block does not exist');
diff --git a/admin/blocks.php b/admin/blocks.php
index 9ecee1d0da6..32553d99929 100644
--- a/admin/blocks.php
+++ b/admin/blocks.php
@@ -6,7 +6,7 @@
     require_once($CFG->libdir.'/blocklib.php');
     require_once($CFG->libdir.'/tablelib.php');
 
-    $confirm  = optional_param('confirm', 0, PARAM_INT);
+    $confirm  = optional_param('confirm', 0, PARAM_BOOL);
     $hide     = optional_param('hide', 0, PARAM_INT);
     $show     = optional_param('show', 0, PARAM_INT);
     $delete   = optional_param('delete', 0, PARAM_INT);
diff --git a/admin/config.php b/admin/config.php
index b2594580fb3..29dba824c44 100644
--- a/admin/config.php
+++ b/admin/config.php
@@ -3,6 +3,8 @@
 
     require_once('../config.php');
 
+    $focus = '';
+
     if ($site = get_site()) {   // If false then this is a new installation
         require_login();
         if (!isadmin()) {
@@ -76,9 +78,6 @@
             $config->locale = $CFG->lang;
         }
     }
-    if (empty($focus)) {
-        $focus = '';
-    }
 
     $sesskey = !empty($USER->id) ? $USER->sesskey : '';
 
@@ -102,7 +101,7 @@
 
 
 /// Get all the configuration fields and helptext
-    include('configvars.php');
+    require('configvars.php');
 
 /// Cycle through the sections to get the sectionnames
     $linktext = '';
diff --git a/admin/configvars.php b/admin/configvars.php
index cb99f3d7e6f..97ecd0568cc 100644
--- a/admin/configvars.php
+++ b/admin/configvars.php
@@ -1,5 +1,6 @@
 <?php // $Id$
       // Shane Elliott
+defined('MOODLE_INTERNAL') or die('Direct access to this script is forbidden.');
 
 /// Add new sitewide configuration variables to this file.
 
diff --git a/admin/creators.html b/admin/creators.html
index 50b9a6d3efb..36b7b264004 100644
--- a/admin/creators.html
+++ b/admin/creators.html
@@ -67,7 +67,7 @@
          <script type="text/javascript">
             function
          </script>
-         <input type="text" name="searchtext" size="30" value="<?php echo $searchtext ?>" 
+         <input type="text" name="searchtext" size="30" value="<?php p($searchtext) ?>" 
                   onFocus ="document.creatorsform.add.disabled=true;
                             document.creatorsform.remove.disabled=true;
                             document.creatorsform.removeselect.selectedIndex=-1;
diff --git a/admin/creators.php b/admin/creators.php
index 18d9c61308e..720c5599ea4 100755
--- a/admin/creators.php
+++ b/admin/creators.php
@@ -1,14 +1,10 @@
 <?PHP // $Id$
       // Admin only script to assign course creator rights to users
 
-    require_once("../config.php");
+    require_once('../config.php');
 
     define("MAX_USERS_PER_PAGE", 50);
 
-    $search = optional_param('search', '', PARAM_CLEAN);
-    $add = optional_param('add', '', PARAM_CLEAN);
-    $remove = optional_param('remove', '', PARAM_CLEAN );
-
     if (! $site = get_site()) {
         redirect("$CFG->wwwroot/$CFG->admin/index.php");
     }
@@ -50,6 +46,7 @@
 
     if (!$frm = data_submitted()) {
         print_simple_box("<center>".get_string("adminhelpassigncreators")."</center>", "center", "50%");
+        $frm = new object();
 
 /// A form was submitted so process the input
 
diff --git a/admin/dbperformance.php b/admin/dbperformance.php
index f378c5457d3..abe311bbedb 100644
--- a/admin/dbperformance.php
+++ b/admin/dbperformance.php
@@ -1,11 +1,11 @@
 <?PHP  // $Id$
        // dbperformance.php - shows latest ADOdb stats for the current server
 
-    require_once("../config.php");
+    require_once('../config.php');
 
-    $topframe = optional_param( 'topframe', '', PARAM_ALPHA);
-    $bottomframe = optional_param( 'bottomframe', '', PARAM_ALPHA);
-    $do = optional_param( 'do','',PARAM_ALPHA);
+    $topframe    = optional_param('topframe', 0, PARAM_BOOL);
+    $bottomframe = optional_param('bottomframe', 0, PARAM_BOOL);
+    $do          = optional_param('do', '', PARAM_ALPHA);
 
     require_login();
 
diff --git a/admin/delete.php b/admin/delete.php
index 2e70e5ae345..0f068d52a30 100644
--- a/admin/delete.php
+++ b/admin/delete.php
@@ -7,8 +7,8 @@
 
     require_login();
 
-    $sure = optional_param('sure', '');
-    $reallysure = optional_param('reallysure', '');
+    $sure       = optional_param('sure', 0, PARAM_BOOL);
+    $reallysure = optional_param('reallysure', 0, PARAM_BOOL);
 
     if (!isadmin()) {
         error('You must be admin to use this script!');
diff --git a/admin/editor.php b/admin/editor.php
index 30b4dc9e219..c530fba7419 100644
--- a/admin/editor.php
+++ b/admin/editor.php
@@ -1,10 +1,12 @@
 <?php // $Id$
 /// configuration routines for HTMLArea editor
 
-    require_once("../config.php");
-    require_login();
+    require_once('../config.php');
+
     $currentpage = optional_param('tab', 1, PARAM_INT);
 
+    require_login();
+
     if (!isadmin()) {
         error("Only admins can access this page");
     }
@@ -27,16 +29,16 @@
     } else {
         // Generate edit form
 
-        $inactive = NULL;
+        $inactive = array();
         switch ( $currentpage ) {
             case 1:
                 $currenttab = 'htmlarea';
-                $inactive = array();
-            break;
+                break;
             case 2:
                 $currenttab = 'tinymce';
-                $inactive = array();
-            break;
+                break;
+            default:
+                error("Unknown currentpage: $currentpage");
         }
 
         $url = 'editor.php?tab=';
diff --git a/admin/enrol.php b/admin/enrol.php
index 6275bd66f58..92404f09235 100644
--- a/admin/enrol.php
+++ b/admin/enrol.php
@@ -2,9 +2,9 @@
        // enrol.php - allows admin to edit all enrollment variables
        //             Yes, enrol is correct English spelling.
 
-    include("../config.php");
+    include('../config.php');
 
-    $enrol = optional_param('enrol', $CFG->enrol, PARAM_ALPHA);
+    $enrol = optional_param('enrol', $CFG->enrol, PARAM_SAFEDIR);
 
     require_login();
 
@@ -43,6 +43,7 @@
 
 
     $modules = get_list_of_plugins("enrol");
+    $options = array();
     foreach ($modules as $module) {
         $options[$module] = get_string("enrolname", "enrol_$module");
     }
diff --git a/admin/environment.php b/admin/environment.php
index 1686e1670ad..29ab5ac07fc 100644
--- a/admin/environment.php
+++ b/admin/environment.php
@@ -35,9 +35,8 @@
 
 
 /// Parameters
-    $action = optional_param('action', '', PARAM_ALPHA);
-    $sesskey = optional_param('sesskey');
-    $version = optional_param('version');
+    $action  = optional_param('action', '', PARAM_ACTION);
+    $version = optional_param('version', '', PARAM_FILE); //
 
 /// Security checks
     require_login();
diff --git a/admin/filter.php b/admin/filter.php
index 47016ed5fc3..51c77e05003 100644
--- a/admin/filter.php
+++ b/admin/filter.php
@@ -2,8 +2,8 @@
     // filter.php
     // Edit text filter settings
 
-    require_once "../config.php";
-    require_once "$CFG->libdir/tablelib.php";
+    require_once '../config.php';
+    require_once $CFG->libdir.'/tablelib.php';
 
     // check for allowed access
     require_login();
@@ -16,10 +16,12 @@
 
     // get parameters
     $param = new Object;
-    $param->filter = required_param( 'filter' );
-    $param->submit = optional_param( 'submit','',PARAM_ALPHA );
-    $param->reset = optional_param( 'reset','',PARAM_ALPHA );
-    $filtername =  substr( $param->filter, strpos( $param->filter, '/' )+1 ) ;
+
+    $param->filter = required_param('filter', PARAM_PATH);
+    $param->submit = optional_param('submit', 0, PARAM_BOOL);
+    $param->reset  = optional_param('reset', 0, PARAM_BOOL);
+
+    $filtername =  substr($param->filter, strpos( $param->filter, '/' )+1 ) ;
 
     // get translated strings for use on page
     $txt = new Object;