From 43bb50931d4a35e7a7cd7d4a1386a66e7029eeed Mon Sep 17 00:00:00 2001
From: Paul Holden <paulh@moodle.com>
Date: Wed, 6 Mar 2024 21:24:45 +0000
Subject: [PATCH] MDL-81135 mod_feedback: stricter cleaning of item type
 parameter.

---
 .../backup/moodle2/restore_feedback_stepslib.php |  1 +
 mod/feedback/edit_item.php                       |  6 +-----
 mod/feedback/lib.php                             | 16 +++++++++++++---
 3 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/mod/feedback/backup/moodle2/restore_feedback_stepslib.php b/mod/feedback/backup/moodle2/restore_feedback_stepslib.php
index 64194503dbf..981dda6a03b 100644
--- a/mod/feedback/backup/moodle2/restore_feedback_stepslib.php
+++ b/mod/feedback/backup/moodle2/restore_feedback_stepslib.php
@@ -70,6 +70,7 @@ class restore_feedback_activity_structure_step extends restore_activity_structur
         $data = (object)$data;
         $oldid = $data->id;
         $data->feedback = $this->get_new_parentid('feedback');
+        $data->typ = clean_param($data->typ, PARAM_ALPHA);
 
         $newitemid = $DB->insert_record('feedback_item', $data);
         $this->set_mapping('feedback_item', $oldid, $newitemid, true); // Can have files
diff --git a/mod/feedback/edit_item.php b/mod/feedback/edit_item.php
index 713397349a4..cbc88b076f9 100644
--- a/mod/feedback/edit_item.php
+++ b/mod/feedback/edit_item.php
@@ -63,15 +63,11 @@ if (!$item->id && $typ === 'pagebreak') {
 }
 
 //get the existing item or create it
-// $formdata->itemid = isset($formdata->itemid) ? $formdata->itemid : NULL;
-if (!$typ || !file_exists($CFG->dirroot.'/mod/feedback/item/'.$typ.'/lib.php')) {
+if (!$typ) {
     throw new \moodle_exception('typemissing', 'feedback', $editurl->out(false));
 }
 
-require_once($CFG->dirroot.'/mod/feedback/item/'.$typ.'/lib.php');
-
 $itemobj = feedback_get_item_class($typ);
-
 $itemobj->build_editform($item, $feedback, $cm);
 
 if ($itemobj->is_cancelled()) {
diff --git a/mod/feedback/lib.php b/mod/feedback/lib.php
index 9c5215c2f2b..23562a62e0d 100644
--- a/mod/feedback/lib.php
+++ b/mod/feedback/lib.php
@@ -1455,6 +1455,7 @@ function feedback_get_template_list($course, $onlyownorpublic = '') {
  *
  * @param string $typ
  * @return feedback_item_base the instance of itemclass
+ * @throws moodle_exception For invalid type
  */
 function feedback_get_item_class($typ) {
     global $CFG;
@@ -1462,11 +1463,20 @@ function feedback_get_item_class($typ) {
     require_once($CFG->dirroot.'/mod/feedback/item/feedback_item_class.php');
 
     //get the class of item-typ
-    $itemclass = 'feedback_item_'.$typ;
+    $typeclean = clean_param($typ, PARAM_ALPHA);
+
+    $itemclass = "feedback_item_{$typeclean}";
+    $itemclasspath = "{$CFG->dirroot}/mod/feedback/item/{$typeclean}/lib.php";
+
     //get the instance of item-class
-    if (!class_exists($itemclass)) {
-        require_once($CFG->dirroot.'/mod/feedback/item/'.$typ.'/lib.php');
+    if (!class_exists($itemclass) && file_exists($itemclasspath)) {
+        require_once($itemclasspath);
     }
+
+    if (!class_exists($itemclass)) {
+        throw new moodle_exception('typemissing', 'feedback');
+    }
+
     return new $itemclass();
 }