From 383776876bc73e2e7cd8d169a19d331f3c441db8 Mon Sep 17 00:00:00 2001
From: Ankit Agarwal <ankit@moodle.com>
Date: Thu, 10 Jul 2014 17:44:59 +0800
Subject: [PATCH] MDL-46148 qtype_calculated: low-level defence against bad
 formulas

This catches things like:
 * Malicious equations coming from backup files.
 * Malicious equations in old questions in the database.
---
 question/type/calculated/question.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/question/type/calculated/question.php b/question/type/calculated/question.php
index 92ad9e79ac8..19f4908beb3 100644
--- a/question/type/calculated/question.php
+++ b/question/type/calculated/question.php
@@ -419,6 +419,10 @@ class qtype_calculated_variable_substituter {
      * @return float the computed result.
      */
     public function calculate($expression) {
+        // Make sure no malicious code is present in the expression. Refer MDL-46148 for details.
+        if ($error = qtype_calculated_find_formula_errors($expression)) {
+            throw new moodle_exception('illegalformulasyntax', 'qtype_calculated', '', $error);
+        }
         return $this->calculate_raw($this->substitute_values_for_eval($expression));
     }