MDL-81135 mod_feedback: stricter cleaning of item type parameter.

mod/feedback/backup/moodle2/restore_feedback_stepslib.php

@@ -70,6 +70,7 @@ class restore_feedback_activity_structure_step extends restore_activity_structur
         $data = (object)$data;
         $oldid = $data->id;
         $data->feedback = $this->get_new_parentid('feedback');
+        $data->typ = clean_param($data->typ, PARAM_ALPHA);
 
         $newitemid = $DB->insert_record('feedback_item', $data);
         $this->set_mapping('feedback_item', $oldid, $newitemid, true); // Can have files

mod/feedback/edit_item.php

@@ -63,15 +63,11 @@ if (!$item->id && $typ === 'pagebreak') {
 }
 
 //get the existing item or create it
-// $formdata->itemid = isset($formdata->itemid) ? $formdata->itemid : NULL;
-if (!$typ || !file_exists($CFG->dirroot.'/mod/feedback/item/'.$typ.'/lib.php')) {
+if (!$typ) {
     throw new \moodle_exception('typemissing', 'feedback', $editurl->out(false));
 }
 
-require_once($CFG->dirroot.'/mod/feedback/item/'.$typ.'/lib.php');
-
 $itemobj = feedback_get_item_class($typ);
-
 $itemobj->build_editform($item, $feedback, $cm);
 
 if ($itemobj->is_cancelled()) {

mod/feedback/lib.php

@@ -1455,6 +1455,7 @@ function feedback_get_template_list($course, $onlyownorpublic = '') {
  *
  * @param string $typ
  * @return feedback_item_base the instance of itemclass
+ * @throws moodle_exception For invalid type
  */
 function feedback_get_item_class($typ) {
     global $CFG;
@@ -1462,11 +1463,20 @@ function feedback_get_item_class($typ) {
     require_once($CFG->dirroot.'/mod/feedback/item/feedback_item_class.php');
 
     //get the class of item-typ
-    $itemclass = 'feedback_item_'.$typ;
+    $typeclean = clean_param($typ, PARAM_ALPHA);
+
+    $itemclass = "feedback_item_{$typeclean}";
+    $itemclasspath = "{$CFG->dirroot}/mod/feedback/item/{$typeclean}/lib.php";
+
     //get the instance of item-class
-    if (!class_exists($itemclass)) {
-        require_once($CFG->dirroot.'/mod/feedback/item/'.$typ.'/lib.php');
+    if (!class_exists($itemclass) && file_exists($itemclasspath)) {
+        require_once($itemclasspath);
     }
+
+    if (!class_exists($itemclass)) {
+        throw new moodle_exception('typemissing', 'feedback');
+    }
+
     return new $itemclass();
 }