parameter cleaup - round 1

admin/admin.php

@@ -1,14 +1,10 @@
 <?PHP // $Id$
       // Admin-only script to assign administrative rights to users
 
-    require_once("../config.php");
+    require_once('../config.php');
     
     define("MAX_USERS_PER_PAGE", 50);
 
-    $add = optional_param('add', "", PARAM_ALPHA);
-    $remove = optional_param('remove', '', PARAM_ALPHA);
-    $search = optional_param('search', '', PARAM_ALPHA);
-
     if (! $site = get_site()) {
         redirect("$CFG->wwwroot/$CFG->admin/index.php");
     }

admin/auth.php

@@ -1,9 +1,9 @@
 <?PHP  // $Id$
        // config.php - allows admin to edit all configuration variables
 
-    include("../config.php");
+    require_once('../config.php');
 
-    $auth = optional_param( 'auth','',PARAM_CLEAN );
+    $auth = optional_param('auth', '', PARAM_SAFEDIR);
 
     require_login();
 
@@ -19,8 +19,9 @@
         error(get_string('confirmsesskeybad', 'error'));
     }
 
-/// If data submitted, then process and store.
+    $focus = '';
 
+/// If data submitted, then process and store.
 
     if ($config = data_submitted()) {
 
@@ -66,6 +67,7 @@
     }
 
     $modules = get_list_of_plugins("auth");
+    $options = array();
     foreach ($modules as $module) {
         $options[$module] = get_string("auth_$module"."title", "auth");
     }
@@ -105,10 +107,6 @@
     }
     $user_fields = array("firstname", "lastname", "email", "phone1", "phone2", "department", "address", "city", "country", "description", "idnumber", "lang");
 
-    if (empty($focus)) {
-        $focus = "";
-    }
-
     $guestoptions[0] = get_string("hide");
     $guestoptions[1] = get_string("show");
 

admin/block.php

@@ -14,7 +14,7 @@
         error("Site isn't defined!");
     }
 
-    $blockid = required_param( 'block',PARAM_INT );
+    $blockid = required_param('block', PARAM_INT);
    
     if(($blockrecord = blocks_get_record($blockid)) === false) {
         error('This block does not exist');

admin/blocks.php

@@ -6,7 +6,7 @@
     require_once($CFG->libdir.'/blocklib.php');
     require_once($CFG->libdir.'/tablelib.php');
 
-    $confirm  = optional_param('confirm', 0, PARAM_INT);
+    $confirm  = optional_param('confirm', 0, PARAM_BOOL);
     $hide     = optional_param('hide', 0, PARAM_INT);
     $show     = optional_param('show', 0, PARAM_INT);
     $delete   = optional_param('delete', 0, PARAM_INT);

admin/config.php

@@ -3,6 +3,8 @@
 
     require_once('../config.php');
 
+    $focus = '';
+
     if ($site = get_site()) {   // If false then this is a new installation
         require_login();
         if (!isadmin()) {
@@ -76,9 +78,6 @@
             $config->locale = $CFG->lang;
         }
     }
-    if (empty($focus)) {
-        $focus = '';
-    }
 
     $sesskey = !empty($USER->id) ? $USER->sesskey : '';
 
@@ -102,7 +101,7 @@
 
 
 /// Get all the configuration fields and helptext
-    include('configvars.php');
+    require('configvars.php');
 
 /// Cycle through the sections to get the sectionnames
     $linktext = '';

admin/configvars.php

@@ -1,5 +1,6 @@
 <?php // $Id$
       // Shane Elliott
+defined('MOODLE_INTERNAL') or die('Direct access to this script is forbidden.');
 
 /// Add new sitewide configuration variables to this file.
 

admin/creators.html

@@ -67,7 +67,7 @@
          <script type="text/javascript">
             function
          </script>
-         <input type="text" name="searchtext" size="30" value="<?php echo $searchtext ?>" 
+         <input type="text" name="searchtext" size="30" value="<?php p($searchtext) ?>" 
                   onFocus ="document.creatorsform.add.disabled=true;
                             document.creatorsform.remove.disabled=true;
                             document.creatorsform.removeselect.selectedIndex=-1;

admin/creators.php

@@ -1,14 +1,10 @@
 <?PHP // $Id$
       // Admin only script to assign course creator rights to users
 
-    require_once("../config.php");
+    require_once('../config.php');
 
     define("MAX_USERS_PER_PAGE", 50);
 
-    $search = optional_param('search', '', PARAM_CLEAN);
-    $add = optional_param('add', '', PARAM_CLEAN);
-    $remove = optional_param('remove', '', PARAM_CLEAN );
-
     if (! $site = get_site()) {
         redirect("$CFG->wwwroot/$CFG->admin/index.php");
     }
@@ -50,6 +46,7 @@
 
     if (!$frm = data_submitted()) {
         print_simple_box("<center>".get_string("adminhelpassigncreators")."</center>", "center", "50%");
+        $frm = new object();
 
 /// A form was submitted so process the input
 

admin/dbperformance.php

@@ -1,11 +1,11 @@
 <?PHP  // $Id$
        // dbperformance.php - shows latest ADOdb stats for the current server
 
-    require_once("../config.php");
+    require_once('../config.php');
 
-    $topframe = optional_param( 'topframe', '', PARAM_ALPHA);
+    $topframe    = optional_param('topframe', 0, PARAM_BOOL);
-    $bottomframe = optional_param( 'bottomframe', '', PARAM_ALPHA);
+    $bottomframe = optional_param('bottomframe', 0, PARAM_BOOL);
-    $do = optional_param( 'do','',PARAM_ALPHA);
+    $do          = optional_param('do', '', PARAM_ALPHA);
 
     require_login();
 

admin/delete.php

@@ -7,8 +7,8 @@
 
     require_login();
 
-    $sure = optional_param('sure', '');
+    $sure       = optional_param('sure', 0, PARAM_BOOL);
-    $reallysure = optional_param('reallysure', '');
+    $reallysure = optional_param('reallysure', 0, PARAM_BOOL);
 
     if (!isadmin()) {
         error('You must be admin to use this script!');

admin/editor.php

@@ -1,10 +1,12 @@
 <?php // $Id$
 /// configuration routines for HTMLArea editor
 
-    require_once("../config.php");
+    require_once('../config.php');
-    require_login();
+
     $currentpage = optional_param('tab', 1, PARAM_INT);
 
+    require_login();
+
     if (!isadmin()) {
         error("Only admins can access this page");
     }
@@ -27,16 +29,16 @@
     } else {
         // Generate edit form
 
-        $inactive = NULL;
+        $inactive = array();
         switch ( $currentpage ) {
             case 1:
                 $currenttab = 'htmlarea';
-                $inactive = array();
                 break;
             case 2:
                 $currenttab = 'tinymce';
-                $inactive = array();
                 break;
+            default:
+                error("Unknown currentpage: $currentpage");
         }
 
         $url = 'editor.php?tab=';

admin/enrol.php

@@ -2,9 +2,9 @@
        // enrol.php - allows admin to edit all enrollment variables
        //             Yes, enrol is correct English spelling.
 
-    include("../config.php");
+    include('../config.php');
 
-    $enrol = optional_param('enrol', $CFG->enrol, PARAM_ALPHA);
+    $enrol = optional_param('enrol', $CFG->enrol, PARAM_SAFEDIR);
 
     require_login();
 
@@ -43,6 +43,7 @@
 
 
     $modules = get_list_of_plugins("enrol");
+    $options = array();
     foreach ($modules as $module) {
         $options[$module] = get_string("enrolname", "enrol_$module");
     }

admin/environment.php

@@ -35,9 +35,8 @@
 
 
 /// Parameters
-    $action = optional_param('action', '', PARAM_ALPHA);
+    $action  = optional_param('action', '', PARAM_ACTION);
-    $sesskey = optional_param('sesskey');
+    $version = optional_param('version', '', PARAM_FILE); //
-    $version = optional_param('version');
 
 /// Security checks
     require_login();

admin/filter.php

@@ -2,8 +2,8 @@
     // filter.php
     // Edit text filter settings
 
-    require_once "../config.php";
+    require_once '../config.php';
-    require_once "$CFG->libdir/tablelib.php";
+    require_once $CFG->libdir.'/tablelib.php';
 
     // check for allowed access
     require_login();
@@ -16,10 +16,12 @@
 
     // get parameters
     $param = new Object;
-    $param->filter = required_param( 'filter' );
+
-    $param->submit = optional_param( 'submit','',PARAM_ALPHA );
+    $param->filter = required_param('filter', PARAM_PATH);
-    $param->reset = optional_param( 'reset','',PARAM_ALPHA );
+    $param->submit = optional_param('submit', 0, PARAM_BOOL);
-    $filtername =  substr( $param->filter, strpos( $param->filter, '/' )+1 ) ;
+    $param->reset  = optional_param('reset', 0, PARAM_BOOL);
+
+    $filtername =  substr($param->filter, strpos( $param->filter, '/' )+1 ) ;
 
     // get translated strings for use on page
     $txt = new Object;