From 696018df63e4b682ddcc4e1ec57f81924947b38a Mon Sep 17 00:00:00 2001
From: stronk7 <stronk7>
Date: Wed, 6 May 2009 09:15:46 +0000
Subject: [PATCH] MDL-18058 glossary rates - secured

---
 lang/en_utf8/glossary.php | 1 +
 mod/glossary/rate.php     | 9 +++++++++
 2 files changed, 10 insertions(+)

diff --git a/lang/en_utf8/glossary.php b/lang/en_utf8/glossary.php
index a2f51445170..45ebac52133 100644
--- a/lang/en_utf8/glossary.php
+++ b/lang/en_utf8/glossary.php
@@ -131,6 +131,7 @@ $string['importedcategories'] = 'Imported categories';
 $string['importedentries'] = 'Imported entries';
 $string['importentries'] = 'Import entries';
 $string['importentriesfromxml'] = 'Import entries from XML file';
+$string['invalidrate'] = 'Invalid glossary rate ($a)';
 $string['isglobal'] = 'Is this glossary global?';
 $string['linkcategory'] = 'Automatically link this category';
 $string['linking'] = 'Auto-linking';
diff --git a/mod/glossary/rate.php b/mod/glossary/rate.php
index 6849c7d66f3..e31cef45840 100644
--- a/mod/glossary/rate.php
+++ b/mod/glossary/rate.php
@@ -45,6 +45,10 @@
     }
 
     if ($data = data_submitted()) {    // form submitted
+
+    /// Calculate scale values
+        $scale_values = make_grades_menu($glossary->scale);
+
         foreach ((array)$data as $entryid => $rating) {
             if (!is_numeric($entryid)) {
                 continue;
@@ -69,6 +73,11 @@
                 continue;
             }
 
+        /// Check rate is valid for that glossary scale values
+            if (!array_key_exists($rating, $scale_values) && $rating != -999) {
+                print_error('invalidrate', 'glossary', '', $rating);
+            }
+
             if ($oldrating = get_record("glossary_ratings", "userid", $USER->id, "entryid", $entry->id)) {
                 //Check if we must delete the rate
                 if ($rating == -999) {