L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-66762 tool_dataprivacy: Sanitize the extra fields in the webservice

Browse Source
This commit is contained in:
Mihail Geshoski
2019-11-07 09:00:19 +08:00
committed by Adrian Greeve
parent 7455b741c9
commit 6ac0f57073
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/tool/dataprivacy/classes/external.php
+3 -3
View File
@@ -713,7 +713,6 @@ class external extends external_api {
list($sql, $params) = users_search_sql($query, '', false, $extrafields, $excludedusers);
$users = $DB->get_records_select('user', $sql, $params, $sort, $fields, 0, 30);
$useroptions = [];
foreach ($users as $user) {
$useroption = (object)[
@@ -722,9 +721,10 @@ class external extends external_api {
];
$useroption->extrafields = [];
foreach ($extrafields as $extrafield) {
// Sanitize the extra fields to prevent potential XSS exploit.
$useroption->extrafields[] = (object)[
'name' => $extrafield,
'value' => $user->{$extrafield}
'value' => s($user->$extrafield)
];
}
$useroptions[$user->id] = $useroption;
@@ -748,7 +748,7 @@ class external extends external_api {
'extrafields' => new external_multiple_structure(
new external_single_structure([
'name' => new external_value(PARAM_TEXT, 'Name of the extrafield.'),
'value' => new external_value(PARAM_RAW_TRIMMED, 'Value of the extrafield.')
'value' => new external_value(PARAM_TEXT, 'Value of the extrafield.')
]
), 'List of extra fields', VALUE_OPTIONAL
)
admin/tool/dataprivacy/templates/form-user-selector-suggestion.mustache
+1 -1
View File
@@ -47,6 +47,6 @@
<span>
<span>{{fullname}}</span>
{{#extrafields}}
<span><small>{{value}}</small></span>
<span><small>{{{value}}}</small></span>
{{/extrafields}}
</span>