MDL-77187 mod_wiki: validate external method sort parameters.

2023-04-19 13:20:25 +00:00
parent ce9cb1156c
commit 4d4635228d
1 changed files with 10 additions and 8 deletions
@@ -449,15 +449,17 @@ class mod_wiki_external extends external_api {
            throw new moodle_exception('cannotviewpage', 'wiki');
        } else if ($subwiki->id != -1) {

-            // Set sort param.
            $options = $params['options'];
-            if (!empty($options['sortby'])) {
-                if ($options['sortdirection'] != 'ASC' && $options['sortdirection'] != 'DESC') {
-                    // Invalid sort direction. Use default.
-                    $options['sortdirection'] = 'ASC';
-                }
-                $sort = $options['sortby'] . ' ' . $options['sortdirection'];
-            }
+
+            // Set sort param.
+            $sort = get_safe_orderby([
+                'id' => 'id',
+                'title' => 'title',
+                'timecreated' => 'timecreated',
+                'timemodified' => 'timemodified',
+                'pageviews' => 'pageviews',
+                'default' => 'title',
+            ], $options['sortby'], $options['sortdirection'], false);

            $pages = wiki_get_page_list($subwiki->id, $sort);
            $caneditpages = wiki_user_can_edit($subwiki);