moodle/moodle
3
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-08-06 01:16:44 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDL-43918 add more validation to $modulename parameter when fetching cms

Browse source
This commit is contained in:
Petr Skoda 2014-08-07 11:13:22 +12:00
parent e609e6cf02
commit b6f299bb69
2 changed files with 323 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

16
lib/datalib.php
View file

@ -1319,6 +1319,10 @@ function get_coursemodule_from_id($modulename, $cmid, $courseid=0, $sectionnum=f
WHERE cm.id = :cmid", $params, $strictness)) {
return false;
}
} else {
if (!core_component::is_valid_plugin_name('mod', $modulename)) {
throw new coding_exception('Invalid modulename parameter');
}
}
$params['modulename'] = $modulename;
@ -1368,6 +1372,10 @@ function get_coursemodule_from_id($modulename, $cmid, $courseid=0, $sectionnum=f
function get_coursemodule_from_instance($modulename, $instance, $courseid=0, $sectionnum=false, $strictness=IGNORE_MISSING) {
global $DB;
if (!core_component::is_valid_plugin_name('mod', $modulename)) {
throw new coding_exception('Invalid modulename parameter');
}
$params = array('instance'=>$instance, 'modulename'=>$modulename);
$courseselect = "";
@ -1406,6 +1414,10 @@ function get_coursemodule_from_instance($modulename, $instance, $courseid=0, $se
function get_coursemodules_in_course($modulename, $courseid, $extrafields='') {
global $DB;
if (!core_component::is_valid_plugin_name('mod', $modulename)) {
throw new coding_exception('Invalid modulename parameter');
}
if (!empty($extrafields)) {
$extrafields = ", $extrafields";
}
@ -1444,6 +1456,10 @@ function get_coursemodules_in_course($modulename, $courseid, $extrafields='') {
function get_all_instances_in_courses($modulename, $courses, $userid=NULL, $includeinvisible=false) {
global $CFG, $DB;
if (!core_component::is_valid_plugin_name('mod', $modulename)) {
throw new coding_exception('Invalid modulename parameter');
}
$outputarray = array();
if (empty($courses) || !is_array($courses) || count($courses) == 0) {