L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

moodlelib MDL-19418 fix bugs introduced when converting clean_param to preg.

Browse Source 
Aumusingly, one of the bugs was detected by a unit test that was in Moodle 1.9, but
which for some reason was not in HEAD. I have tidied up the clean_param unit tests
and added a few more.
This commit is contained in:
Tim Hunt
2010-05-12 12:05:59 +00:00
parent 36798745fb
commit 14f3ad159d
2 changed files with 47 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/moodlelib.php
+1 -1
View File
@@ -597,7 +597,7 @@ function clean_param($param, $type) {
return preg_replace('/[^a-zA-Z0-9\/_-]/i', '', $param);
case PARAM_FILE: // Strip all suspicious characters from filename
$param = preg_replace('~[[:cntrl:]]|[&<>"`\|\':\\/]~u', '', $param);
$param = preg_replace('~[[:cntrl:]]|[&<>"`\|\':\\\\/]~u', '', $param);
$param = preg_replace('~\.\.+~', '', $param);
if ($param === '.') {
$param = '';
lib/simpletest/testmoodlelib.php
+46 -38
View File
@@ -240,49 +240,37 @@ class moodlelib_test extends UnitTestCase {
$this->assertEqual(optional_param('username', 'default_user', PARAM_CLEAN), 'default_user');
}
/**
* Used by {@link optional_param()} and {@link required_param()} to
* clean the variables and/or cast to specific types, based on
* an options field.
* <code>
* $course->format = clean_param($course->format, PARAM_ALPHA);
* $selectedgrade_item = clean_param($selectedgrade_item, PARAM_CLEAN);
* </code>
*
* @uses $CFG
* @uses PARAM_CLEAN
* @uses PARAM_INT
* @uses PARAM_INTEGER
* @uses PARAM_ALPHA
* @uses PARAM_ALPHANUM
* @uses PARAM_NOTAGS
* @uses PARAM_ALPHAEXT
* @uses PARAM_BOOL
* @uses PARAM_SAFEDIR
* @uses PARAM_FILE
* @uses PARAM_PATH
* @uses PARAM_HOST
* @uses PARAM_URL
* @uses PARAM_LOCALURL
* @uses PARAM_CLEANHTML
* @uses PARAM_SEQUENCE
* @uses PARAM_USERNAME
* @uses PARAM_STRINGID
* @param mixed $param the variable we are cleaning
* @param int $type expected format of param after cleaning.
* @return mixed
*/
function test_clean_param() {
global $CFG;
// Test unknown parameter type
// Test Raw param
function test_clean_param_raw() {
$this->assertEqual(clean_param('#()*#,9789\'".,<42897></?$(*DSFMO#$*)(SDJ)($*)', PARAM_RAW),
'#()*#,9789\'".,<42897></?$(*DSFMO#$*)(SDJ)($*)');
}
function test_clean_param_clean() {
$this->assertEqual(clean_param('#()*#,9789\'".,<42897></?$(*DSFMO#$*)(SDJ)($*)', PARAM_CLEAN),
'#()*#,9789\'".,');
}
function test_clean_param_alpha() {
$this->assertEqual(clean_param('#()*#,9789\'".,<42897></?$(*DSFMO#$*)(SDJ)($*)', PARAM_ALPHA),
'DSFMOSDJ');
}
function test_clean_param_alphanum() {
$this->assertEqual(clean_param('#()*#,9789\'".,<42897></?$(*DSFMO#$*)(SDJ)($*)', PARAM_ALPHANUM),
'978942897DSFMOSDJ');
}
function test_clean_param_alphaext() {
$this->assertEqual(clean_param('#()*#,9789\'".,<42897></?$(*DSFMO#$*)(SDJ)($*)', PARAM_ALPHAEXT),
'DSFMOSDJ');
}
function test_clean_param_sequence() {
$this->assertEqual(clean_param('#()*#,9789\'".,<42897></?$(*DSFMO#$*)(SDJ)($*)', PARAM_SEQUENCE),
',9789,42897');
}
function test_clean_param_url() {
// Test PARAM_URL and PARAM_LOCALURL a bit
$this->assertEqual(clean_param('http://google.com/', PARAM_URL), 'http://google.com/');
$this->assertEqual(clean_param('http://some.very.long.and.silly.domain/with/a/path/', PARAM_URL), 'http://some.very.long.and.silly.domain/with/a/path/');
@@ -290,16 +278,34 @@ class moodlelib_test extends UnitTestCase {
$this->assertEqual(clean_param('http://0.255.1.1/numericip.php', PARAM_URL), 'http://0.255.1.1/numericip.php');
$this->assertEqual(clean_param('/just/a/path', PARAM_URL), '/just/a/path');
$this->assertEqual(clean_param('funny:thing', PARAM_URL), '');
}
function test_clean_param_localurl() {
global $CFG;
$this->assertEqual(clean_param('http://google.com/', PARAM_LOCALURL), '');
$this->assertEqual(clean_param('http://some.very.long.and.silly.domain/with/a/path/', PARAM_LOCALURL), '');
$this->assertEqual(clean_param($CFG->wwwroot, PARAM_LOCALURL), $CFG->wwwroot);
$this->assertEqual(clean_param('/just/a/path', PARAM_LOCALURL), '/just/a/path');
$this->assertEqual(clean_param('funny:thing', PARAM_LOCALURL), '');
$this->assertEqual(clean_param('course/view.php?id=3', PARAM_LOCALURL), 'course/view.php?id=3');
}
function test_clean_param_file() {
$this->assertEqual(clean_param('correctfile.txt', PARAM_FILE), 'correctfile.txt');
$this->assertEqual(clean_param('b\'a<d`\\/fi:l>e.t"x|t', PARAM_FILE), 'badfile.txt');
$this->assertEqual(clean_param('../parentdirfile.txt', PARAM_FILE), 'parentdirfile.txt');
//The following behaviours have been maintained although they seem a little odd
$this->assertEqual(clean_param('funny:thing', PARAM_FILE), 'funnything');
$this->assertEqual(clean_param('./currentdirfile.txt', PARAM_FILE), '.currentdirfile.txt');
$this->assertEqual(clean_param('c:\temp\windowsfile.txt', PARAM_FILE), 'ctempwindowsfile.txt');
$this->assertEqual(clean_param('/home/user/linuxfile.txt', PARAM_FILE), 'homeuserlinuxfile.txt');
$this->assertEqual(clean_param('~/myfile.txt', PARAM_FILE), '~myfile.txt');
}
function test_clean_param_username() {
global $CFG;
$currentstatus = $CFG->extendedusernamechars;
// Run tests with extended character == FALSE;
$CFG->extendedusernamechars = FALSE;
$this->assertEqual(clean_param('johndoe123', PARAM_USERNAME), 'johndoe123' );
@@ -326,7 +332,9 @@ class moodlelib_test extends UnitTestCase {
$this->assertEqual(clean_param('johndóé ', PARAM_USERNAME), 'johndóé');
$CFG->extendedusernamechars = $currentstatus;
}
function test_clean_param_stringid() {
// Test string identifiers validation
// valid strings:
$this->assertEqual(clean_param('validstring', PARAM_STRINGID), 'validstring');