From 44971ebf69dc94aacb6964ebfeb40cde8b68bbc0 Mon Sep 17 00:00:00 2001 From: Laurent David Date: Wed, 5 Feb 2025 11:12:27 +0100 Subject: [PATCH] MDL-84271 core_course: Validate module list in search * We need to validate the list of modules in the course search Co-authored-by: Lars Bonczek --- course/classes/category.php | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/course/classes/category.php b/course/classes/category.php index 72538c8e8fb..2f0f3b5a7b7 100644 --- a/course/classes/category.php +++ b/course/classes/category.php @@ -1645,8 +1645,13 @@ class core_course_category implements renderable, cacheable_object, IteratorAggr $params = array('blockname' => $blockname); } else if (!empty($search['modulelist'])) { // Search courses that have module with specified name. - $where = "c.id IN (SELECT DISTINCT module.course ". - "FROM {".$search['modulelist']."} module)"; + if (array_key_exists($search['modulelist'], core_component::get_plugin_list('mod'))) { + // If module plugin exists, use module name as table name. + $where = "c.id IN (SELECT DISTINCT module.course FROM {{$search['modulelist']}} module)"; + } else { + // Otherwise, return empty list of courses. + $where = '1=0'; + } $params = array(); } else if (!empty($search['tagid'])) { // Search courses that are tagged with the specified tag.