From 63ba5e591d6fed015a27e957916b884fccc4f6f9 Mon Sep 17 00:00:00 2001
From: Laurent David <lmedavid@gmail.com>
Date: Thu, 21 Mar 2024 12:22:13 +0100
Subject: [PATCH] MDL-81267 mod_data: Clean field type before inclusion

* Filter out wrong field types when restoring or creating a field.
---
 mod/data/backup/moodle2/restore_data_stepslib.php | 1 +
 mod/data/lib.php                                  | 2 ++
 mod/data/locallib.php                             | 2 ++
 3 files changed, 5 insertions(+)

diff --git a/mod/data/backup/moodle2/restore_data_stepslib.php b/mod/data/backup/moodle2/restore_data_stepslib.php
index 8c6744192d2..efc0ef3e8fd 100644
--- a/mod/data/backup/moodle2/restore_data_stepslib.php
+++ b/mod/data/backup/moodle2/restore_data_stepslib.php
@@ -87,6 +87,7 @@ class restore_data_activity_structure_step extends restore_activity_structure_st
         $oldid = $data->id;
 
         $data->dataid = $this->get_new_parentid('data');
+        $data->type = clean_param($data->type, PARAM_ALPHA);
 
         // insert the data_fields record
         $newitemid = $DB->insert_record('data_fields', $data);
diff --git a/mod/data/lib.php b/mod/data/lib.php
index 464e6dadd89..e1b239125f9 100644
--- a/mod/data/lib.php
+++ b/mod/data/lib.php
@@ -959,6 +959,7 @@ function data_get_field_from_id($fieldid, $data){
 function data_get_field_new($type, $data) {
     global $CFG;
 
+    $type = clean_param($type, PARAM_ALPHA);
     $filepath = $CFG->dirroot.'/mod/data/field/'.$type.'/field.class.php';
     // It should never access this method if the subfield class doesn't exist.
     if (!file_exists($filepath)) {
@@ -986,6 +987,7 @@ function data_get_field($field, $data, $cm=null) {
     if (!isset($field->type)) {
         return new data_field_base($field);
     }
+    $field->type = clean_param($field->type, PARAM_ALPHA);
     $filepath = $CFG->dirroot.'/mod/data/field/'.$field->type.'/field.class.php';
     if (!file_exists($filepath)) {
         return new data_field_base($field);
diff --git a/mod/data/locallib.php b/mod/data/locallib.php
index df4d1c75f70..de36ed31360 100644
--- a/mod/data/locallib.php
+++ b/mod/data/locallib.php
@@ -976,6 +976,7 @@ function data_get_tag_title_field($dataid) {
         if ($field->addtemplateposition === false) {
             continue;
         }
+        $field->type = clean_param($field->type, PARAM_ALPHA);
         $filepath = $CFG->dirroot . '/mod/data/field/' . $field->type . '/field.class.php';
         if (!file_exists($filepath)) {
             continue;
@@ -1019,6 +1020,7 @@ function data_get_tag_title_for_entry($field, $entry) {
     if (!isset($field->type)) {
         return null;
     }
+    $field->type = clean_param($field->type, PARAM_ALPHA);
     $filepath = $CFG->dirroot . '/mod/data/field/' . $field->type . '/field.class.php';
     if (!file_exists($filepath)) {
         return null;