diff --git a/admin/langimport.php b/admin/langimport.php index 4aa614b2193..713f608ad0b 100644 --- a/admin/langimport.php +++ b/admin/langimport.php @@ -43,7 +43,7 @@ if (!empty($CFG->skiplangupgrade)) { } $mode = optional_param('mode', 0, PARAM_INT); // action -$pack = optional_param('pack', array(), PARAM_SAFEDIR); // pack to install +$pack = optional_param_array('pack', array(), PARAM_SAFEDIR); // pack to install $uninstalllang = optional_param('uninstalllang', '', PARAM_LANG); // installed pack to uninstall $confirm = optional_param('confirm', 0, PARAM_BOOL); // uninstallation confirmation diff --git a/admin/report/capability/index.php b/admin/report/capability/index.php index c6afaf39be2..71ba109f94e 100644 --- a/admin/report/capability/index.php +++ b/admin/report/capability/index.php @@ -18,7 +18,7 @@ require_capability('moodle/role:manage', $systemcontext); // Get URL parameters. $capability = optional_param('capability', '', PARAM_CAPABILITY); -$roleids = optional_param('roles', array('0'), PARAM_INTEGER); +$roleids = optional_param_array('roles', array('0'), PARAM_INTEGER); // Clean the passed in list of role ids. If 'All' selected as an option, or // if none were selected, do all roles. diff --git a/admin/report/customlang/edit.php b/admin/report/customlang/edit.php index 6e9a7f26a4d..99c2ed9ae6b 100644 --- a/admin/report/customlang/edit.php +++ b/admin/report/customlang/edit.php @@ -59,8 +59,8 @@ if ($filter->is_cancelled()) { } if ($translatorsubmitted) { - $strings = optional_param('cust', array(), PARAM_RAW); - $updates = optional_param('updates', array(), PARAM_INT); + $strings = optional_param_array('cust', array(), PARAM_RAW); + $updates = optional_param_array('updates', array(), PARAM_INT); $checkin = optional_param('savecheckin', false, PARAM_RAW); if ($checkin === false) { diff --git a/admin/report/unittest/dbtest.php b/admin/report/unittest/dbtest.php index 63060a16603..ae57bcfb68f 100644 --- a/admin/report/unittest/dbtest.php +++ b/admin/report/unittest/dbtest.php @@ -14,7 +14,7 @@ require_once('ex_reporter.php'); $showpasses = optional_param('showpasses', false, PARAM_BOOL); $codecoverage = optional_param('codecoverage', false, PARAM_BOOL); -$selected = optional_param('selected', array(), PARAM_INT); +$selected = optional_param_array('selected', array(), PARAM_INT); // Print the header and check access. admin_externalpage_setup('reportdbtest'); diff --git a/group/index.php b/group/index.php index 0eeaf4d2926..3d8bfb03c1d 100644 --- a/group/index.php +++ b/group/index.php @@ -19,7 +19,7 @@ $action = groups_param_action(); if ($groupid) { $groupids = array($groupid); } else { - $groupids = optional_param('groups', array(), PARAM_INT); + $groupids = optional_param_array('groups', array(), PARAM_INT); } $singlegroup = (count($groupids) == 1); diff --git a/lib/filelib.php b/lib/filelib.php index 5cc33d0e213..1e0ef669b04 100644 --- a/lib/filelib.php +++ b/lib/filelib.php @@ -588,18 +588,27 @@ function file_get_drafarea_files($draftitemid, $filepath = '/') { * @return integer the itemid, or 0 if there is not one yet. */ function file_get_submitted_draft_itemid($elname) { - $param = optional_param($elname, 0, PARAM_INT); - if ($param) { - require_sesskey(); + // this is a nasty hack, ideally all new elements should use arrays here or there should be a new parameter + if (!isset($_REQUEST[$elname])) { + return 0; } - if (is_array($param)) { + if (is_array($_REQUEST[$elname])) { + $param = optional_param_array($elname, 0, PARAM_INT); if (!empty($param['itemid'])) { $param = $param['itemid']; } else { debugging('Missing itemid, maybe caused by unset maxfiles option', DEBUG_DEVELOPER); return false; } + + } else { + $param = optional_param($elname, 0, PARAM_INT); } + + if ($param) { + require_sesskey(); + } + return $param; } diff --git a/lib/formslib.php b/lib/formslib.php index b8292051008..4b02f70f9ed 100644 --- a/lib/formslib.php +++ b/lib/formslib.php @@ -1384,9 +1384,14 @@ class MoodleQuickForm extends HTML_QuickForm_DHTMLRulesTableless { } else { foreach ($submission as $key=>$s) { if (array_key_exists($key, $this->_types)) { - $submission[$key] = clean_param($s, $this->_types[$key]); + $type = $this->_types[$key]; } else { - $submission[$key] = clean_param($s, PARAM_RAW); + $type = PARAM_RAW; + } + if (is_array($s)) { + $submission[$key] = clean_param_array($s, $type, true); + } else { + $submission[$key] = clean_param($s, $type); } } $this->_submitValues = $submission; diff --git a/mod/choice/report.php b/mod/choice/report.php index bbd673b0010..b9ef1455909 100644 --- a/mod/choice/report.php +++ b/mod/choice/report.php @@ -7,7 +7,7 @@ $format = optional_param('format', CHOICE_PUBLISH_NAMES, PARAM_INT); $download = optional_param('download', '', PARAM_ALPHA); $action = optional_param('action', '', PARAM_ALPHA); - $attemptids = optional_param('attemptid', array(), PARAM_INT); //get array of responses to delete. + $attemptids = optional_param_array('attemptid', array(), PARAM_INT); //get array of responses to delete. $url = new moodle_url('/mod/choice/report.php', array('id'=>$id)); if ($format !== CHOICE_PUBLISH_NAMES) { @@ -219,7 +219,7 @@ $results = prepare_choice_show_results($choice, $course, $cm, $users); $renderer = $PAGE->get_renderer('mod_choice'); echo $renderer->display_result($results, has_capability('mod/choice:readresponses', $context)); - + //now give links for downloading spreadsheets. if (!empty($users) && has_capability('mod/choice:downloadresponses',$context)) { $downloadoptions = array(); diff --git a/mod/choice/view.php b/mod/choice/view.php index 2e11c5e491e..b35e017c526 100644 --- a/mod/choice/view.php +++ b/mod/choice/view.php @@ -6,7 +6,7 @@ $id = required_param('id', PARAM_INT); // Course Module ID $action = optional_param('action', '', PARAM_ALPHA); - $attemptids = optional_param('attemptid', array(), PARAM_INT); // array of attempt ids for delete action + $attemptids = optional_param_array('attemptid', array(), PARAM_INT); // array of attempt ids for delete action $url = new moodle_url('/mod/choice/view.php', array('id'=>$id)); if ($action !== '') { diff --git a/mod/data/field/checkbox/field.class.php b/mod/data/field/checkbox/field.class.php index 8b5c8987459..7571d077a5a 100644 --- a/mod/data/field/checkbox/field.class.php +++ b/mod/data/field/checkbox/field.class.php @@ -96,7 +96,7 @@ class data_field_checkbox extends data_field_base { } function parse_search_field() { - $selected = optional_param('f_'.$this->field->id, array(), PARAM_NOTAGS); + $selected = optional_param_array('f_'.$this->field->id, array(), PARAM_NOTAGS); $allrequired = optional_param('f_'.$this->field->id.'_allreq', 0, PARAM_BOOL); if (empty($selected)) { // no searching diff --git a/mod/data/field/multimenu/field.class.php b/mod/data/field/multimenu/field.class.php index 170af176b0a..f3fe90b161d 100644 --- a/mod/data/field/multimenu/field.class.php +++ b/mod/data/field/multimenu/field.class.php @@ -122,7 +122,7 @@ class data_field_multimenu extends data_field_base { } function parse_search_field() { - $selected = optional_param('f_'.$this->field->id, array(), PARAM_NOTAGS); + $selected = optional_param_array('f_'.$this->field->id, array(), PARAM_NOTAGS); $allrequired = optional_param('f_'.$this->field->id.'_allreq', 0, PARAM_BOOL); if (empty($selected)) { // no searching diff --git a/mod/quiz/report/grading/report.php b/mod/quiz/report/grading/report.php index 44c420f56e1..4babb14b1f3 100644 --- a/mod/quiz/report/grading/report.php +++ b/mod/quiz/report/grading/report.php @@ -439,7 +439,7 @@ class quiz_grading_report extends quiz_default_report { if (!$qubaids) { return false; } - $qubaids = clean_param(explode(',', $qubaids), PARAM_INT); + $qubaids = clean_param_array(explode(',', $qubaids), PARAM_INT); $slots = optional_param('slots', '', PARAM_SEQUENCE); if (!$slots) { @@ -471,7 +471,7 @@ class quiz_grading_report extends quiz_default_report { return; } - $qubaids = clean_param(explode(',', $qubaids), PARAM_INT); + $qubaids = clean_param_array(explode(',', $qubaids), PARAM_INT); $attempts = $this->load_attempts_by_usage_ids($qubaids); $transaction = $DB->start_delegated_transaction(); diff --git a/mod/quiz/report/overview/report.php b/mod/quiz/report/overview/report.php index aec78095ae2..58041fb2754 100644 --- a/mod/quiz/report/overview/report.php +++ b/mod/quiz/report/overview/report.php @@ -133,14 +133,14 @@ class quiz_overview_report extends quiz_attempt_report { // Process actions. if (empty($currentgroup) || $groupstudents) { if (optional_param('delete', 0, PARAM_BOOL) && confirm_sesskey()) { - if ($attemptids = optional_param('attemptid', array(), PARAM_INT)) { + if ($attemptids = optional_param_array('attemptid', array(), PARAM_INT)) { require_capability('mod/quiz:deleteattempts', $this->context); $this->delete_selected_attempts($quiz, $cm, $attemptids, $allowed); redirect($reporturl->out(false, $displayoptions)); } } else if (optional_param('regrade', 0, PARAM_BOOL) && confirm_sesskey()) { - if ($attemptids = optional_param('attemptid', array(), PARAM_INT)) { + if ($attemptids = optional_param_array('attemptid', array(), PARAM_INT)) { require_capability('mod/quiz:regrade', $this->context); $this->regrade_attempts($quiz, false, $groupstudents, $attemptids); redirect($reporturl->out(false, $displayoptions)); diff --git a/mod/quiz/report/responses/report.php b/mod/quiz/report/responses/report.php index 5abf1e2f058..904ff587650 100644 --- a/mod/quiz/report/responses/report.php +++ b/mod/quiz/report/responses/report.php @@ -124,7 +124,7 @@ class quiz_responses_report extends quiz_attempt_report { $allowed = array(); } - if ($attemptids = optional_param('attemptid', array(), PARAM_INT) && confirm_sesskey()) { + if ($attemptids = optional_param_array('attemptid', array(), PARAM_INT) && confirm_sesskey()) { require_capability('mod/quiz:deleteattempts', $this->context); $this->delete_selected_attempts($quiz, $cm, $attemptids, $allowed); redirect($reporturl->out(false, $displayoptions)); diff --git a/mod/scorm/report/basic/report.php b/mod/scorm/report/basic/report.php index fc849a7bffe..8f7c8becaf9 100644 --- a/mod/scorm/report/basic/report.php +++ b/mod/scorm/report/basic/report.php @@ -35,7 +35,7 @@ class scorm_basic_report extends scorm_default_report { global $CFG, $DB, $OUTPUT, $PAGE; $contextmodule= get_context_instance(CONTEXT_MODULE, $cm->id); $action = optional_param('action', '', PARAM_ALPHA); - $attemptids = optional_param('attemptid', array(), PARAM_RAW); + $attemptids = optional_param_array('attemptid', array(), PARAM_RAW); if ($action == 'delete' && has_capability('mod/scorm:deleteresponses', $contextmodule) && confirm_sesskey()) { if (scorm_delete_responses($attemptids, $scorm)) { //delete responses. diff --git a/repository/lib.php b/repository/lib.php index 5216e1fb9c6..bbed2bedc64 100644 --- a/repository/lib.php +++ b/repository/lib.php @@ -1501,7 +1501,7 @@ abstract class repository { public function filter(&$value) { $pass = false; - $accepted_types = optional_param('accepted_types', '', PARAM_RAW); + $accepted_types = optional_param_array('accepted_types', '', PARAM_RAW); $ft = new filetype_parser; //$ext = $ft->get_extensions($this->supported_filetypes()); if (isset($value['children'])) { diff --git a/repository/repository_ajax.php b/repository/repository_ajax.php index 7f0e1276539..463673160aa 100644 --- a/repository/repository_ajax.php +++ b/repository/repository_ajax.php @@ -46,7 +46,7 @@ $itemid = optional_param('itemid', 0, PARAM_INT); // Itemid $page = optional_param('page', '', PARAM_RAW); // Page $maxbytes = optional_param('maxbytes', 0, PARAM_INT); // Maxbytes $req_path = optional_param('p', '', PARAM_RAW); // Path -$accepted_types = optional_param('accepted_types', '*', PARAM_RAW); +$accepted_types = optional_param_array('accepted_types', '*', PARAM_RAW); $saveas_filename = optional_param('title', '', PARAM_FILE); // save as file name $saveas_path = optional_param('savepath', '/', PARAM_PATH); // save as file path $search_text = optional_param('s', '', PARAM_CLEANHTML); diff --git a/repository/upload/lib.php b/repository/upload/lib.php index 82850423a95..bf061d3817c 100644 --- a/repository/upload/lib.php +++ b/repository/upload/lib.php @@ -44,7 +44,7 @@ class repository_upload extends repository { public function upload($saveas_filename, $maxbytes) { global $USER, $CFG; - $types = optional_param('accepted_types', '*', PARAM_RAW); + $types = optional_param_array('accepted_types', '*', PARAM_RAW); if ((is_array($types) and in_array('*', $types)) or $types == '*') { $this->mimetypes = '*'; } else { diff --git a/tag/manage.php b/tag/manage.php index c4fae4c13e0..e0edeb94bf5 100644 --- a/tag/manage.php +++ b/tag/manage.php @@ -29,9 +29,9 @@ require_once('lib.php'); define('SHOW_ALL_PAGE_SIZE', 50000); define('DEFAULT_PAGE_SIZE', 30); -$tagschecked = optional_param('tagschecked', array(), PARAM_INT); -$newnames = optional_param('newname', array(), PARAM_TAG); -$tagtypes = optional_param('tagtypes', array(), PARAM_ALPHA); +$tagschecked = optional_param_array('tagschecked', array(), PARAM_INT); +$newnames = optional_param_array('newname', array(), PARAM_TAG); +$tagtypes = optional_param_array('tagtypes', array(), PARAM_ALPHA); $action = optional_param('action', '', PARAM_ALPHA); $perpage = optional_param('perpage', DEFAULT_PAGE_SIZE, PARAM_INT); diff --git a/user/addnote.php b/user/addnote.php index 06cae6b97f2..5a0d0a8d9bb 100644 --- a/user/addnote.php +++ b/user/addnote.php @@ -27,9 +27,9 @@ require_once("../config.php"); require_once($CFG->dirroot .'/notes/lib.php'); $id = required_param('id', PARAM_INT); // course id -$users = optional_param('userid', array(), PARAM_INT); // array of user id -$contents = optional_param('contents', array(), PARAM_RAW); // array of user notes -$states = optional_param('states', array(), PARAM_ALPHA); // array of notes states +$users = optional_param_array('userid', array(), PARAM_INT); // array of user id +$contents = optional_param_array('contents', array(), PARAM_RAW); // array of user notes +$states = optional_param_array('states', array(), PARAM_ALPHA); // array of notes states $PAGE->set_url('/user/addnote.php', array('id'=>$id)); diff --git a/user/groupaddnote.php b/user/groupaddnote.php index 6d53875e9f7..90f1b3d9d6c 100644 --- a/user/groupaddnote.php +++ b/user/groupaddnote.php @@ -27,7 +27,7 @@ require_once("../config.php"); require_once($CFG->dirroot .'/notes/lib.php'); $id = required_param('id', PARAM_INT); // course id -$users = optional_param('userid', array(), PARAM_INT); // array of user id +$users = optional_param_array('userid', array(), PARAM_INT); // array of user id $content = optional_param('content', '', PARAM_RAW); // note content $state = optional_param('state', '', PARAM_ALPHA); // note publish state diff --git a/user/selector/lib.php b/user/selector/lib.php index f45686bee03..4ac03b04400 100644 --- a/user/selector/lib.php +++ b/user/selector/lib.php @@ -353,7 +353,7 @@ abstract class user_selector_base { */ protected function load_selected_users() { // See if we got anything. - $userids = optional_param($this->name, array(), PARAM_INTEGER); + $userids = optional_param_array($this->name, array(), PARAM_INTEGER); if (empty($userids)) { return array(); }