moodle/moodle
3
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-08-04 16:36:37 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDL-47965 tag: Enforcing security of tag auto completion

Browse source
This commit is contained in:
Frederic Massart 2014-10-30 14:34:24 +08:00 • committed by Sam Hemelryk
parent babaf596e1
commit 5d0b3b21d6
2 changed files with 26 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tag/tag.js
View file

@ -10,13 +10,13 @@ YUI().use('yui2-autocomplete', 'yui2-datasource', 'yui2-animation', 'yui2-connec
fieldDelim: "\t" fieldDelim: "\t"
}; };
myDataSource.maxCacheEntries = 60; myDataSource.maxCacheEntries = 60;
myDataSource.minQueryLength = 3;
// Instantiate the AutoComplete // Instantiate the AutoComplete
var myAutoComp = new Y.YUI2.widget.AutoComplete("id_relatedtags", "relatedtags-autocomplete", myDataSource); var myAutoComp = new Y.YUI2.widget.AutoComplete("id_relatedtags", "relatedtags-autocomplete", myDataSource);
document.getElementById('id_relatedtags').style.width = '30%'; document.getElementById('id_relatedtags').style.width = '30%';
myAutoComp.allowBrowserAutocomplete = false; myAutoComp.allowBrowserAutocomplete = false;
myAutoComp.maxResultsDisplayed = 20; myAutoComp.maxResultsDisplayed = 20;
myAutoComp.minQueryLength = 3;
myAutoComp.delimChar = [","," "]; myAutoComp.delimChar = [","," "];
myAutoComp.formatResult = function(oResultData, sQuery, sResultMatch) { myAutoComp.formatResult = function(oResultData, sQuery, sResultMatch) {
return (sResultMatch); return (sResultMatch);

34
tag/tag_autocomplete.php
View file

@ -27,16 +27,32 @@ define('AJAX_SCRIPT', true);
require_once('../config.php'); require_once('../config.php');
require_once('lib.php'); require_once('lib.php');
require_login();
if (empty($CFG->usetags)) { if (empty($CFG->usetags)) {
print_error('tagsaredisabled', 'tag'); // Tags are disabled.
die();
} }
$query = optional_param('query', '', PARAM_RAW); require_login(0, false);
if (isguestuser()) {
if ($similar_tags = tag_autocomplete($query)) { // Guests should not be using this.
foreach ($similar_tags as $tag) { die();
echo clean_param($tag->name, PARAM_TAG) . "\t" . tag_display_name($tag) . "\n";
}
} }
// If a user cannot edit tags, they cannot add related tags which is what this auto complete is for.
require_capability('moodle/tag:edit', context_system::instance());
$query = optional_param('query', '', PARAM_TAG);
echo $OUTPUT->header();
// Limit the query to a minimum of 3 characters.
$similartags = array();
if (core_text::strlen($query) >= 3) {
$similartags = tag_autocomplete($query);
}
foreach ($similartags as $tag) {
echo clean_param($tag->name, PARAM_TAG) . "\t" . tag_display_name($tag) . "\n";
}
echo $OUTPUT->footer();