L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Changed all optional_variable() and require_variable() to equivalent

Browse Source 
optional_param() and required_param() for greater security.
This commit is contained in:
thepurpleblob
2005-06-10 19:54:41 +00:00
parent 03c2200ef4
commit 70e3da07fd
10 changed files with 35 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod/forum/discuss.php
+6 -6
View File
@@ -6,12 +6,12 @@
require_once("../../config.php");
require_once("lib.php");
require_variable($d); // Discussion ID
optional_variable($parent); // If set, then display this post and all children.
optional_variable($mode); // If set, changes the layout of the thread
optional_variable($move); // If set, moves this discussion to another forum
optional_variable($mark); // Used for tracking read posts if user initiated.
optional_variable($postid); // Used for tracking read posts if user initiated.
$d = required_param('d',PARAM_INT); // Discussion ID
$parent = optional_param('parent',0,PARAM_INT); // If set, then display this post and all children.
$mode = optional_param('mode',0,PARAM_INT); // If set, changes the layout of the thread
$move = optional_param('move',0,PARAM_INT); // If set, moves this discussion to another forum
$mark = optional_param('mark',0,PARAM_INT); // Used for tracking read posts if user initiated.
$postid = optional_param('postid',0,PARAM_INT); // Used for tracking read posts if user initiated.
if (! $discussion = get_record("forum_discussions", "id", $d)) {
error("Discussion ID was incorrect or no longer exists");
mod/forum/index.php
+1 -1
View File
@@ -4,7 +4,7 @@
require_once("lib.php");
require_once("$CFG->libdir/rsslib.php");
optional_variable($id); // course
$id = optional_param('id',0,PARAM_INT); // course
if ($id) {
if (! $course = get_record("course", "id", $id)) {
mod/forum/markposts.php
+4 -4
View File
@@ -5,10 +5,10 @@
require_once("../../config.php");
require_once("lib.php");
require_variable($f); // The forum to mark
require_variable($mark); // Read or unread?
optional_variable($d); // Discussion to mark.
optional_variable($returnpage, 'index.php'); // Page to return to.
$f = required_param('f',PARAM_INT); // The forum to mark
$mark = required_param('mark',PARAM_ALPHA); // Read or unread?
$d = optional_param('d',0,PARAM_INT); // Discussion to mark.
$returnpage = optional_param('returnpage', 'index.php', PARAM_FILE); // Page to return to.
if (! $forum = get_record("forum", "id", $f)) {
error("Forum ID was incorrect");
mod/forum/post.php
+12 -6
View File
@@ -6,6 +6,12 @@
require_once('lib.php');
$reply = optional_param('reply', 0, PARAM_INT);
$forum = optional_param('forum', 0, PARAM_INT);
$edit = optional_param('edit', 0, PARAM_INT);
$delete = optional_param('delete', 0, PARAM_INT);
$prune = optional_param('prune',0,PARAM_INT);
$name = optional_param('name','',PARAM_CLEAN);
$confirm = optional_param('confirm',0,PARAM_INT);
if (isguest()) {
$wwwroot = $CFG->wwwroot.'/login/index.php';
@@ -193,7 +199,7 @@
}
}
} else if (isset($forum)) { // User is starting a new discussion in a forum
} else if (!empty($forum)) { // User is starting a new discussion in a forum
$SESSION->fromurl = $_SERVER["HTTP_REFERER"];
@@ -281,7 +287,7 @@
unset($SESSION->fromdiscussion);
} else if (isset($edit)) { // User is editing their own post
} else if (!empty($edit)) { // User is editing their own post
$adminedit = (isadmin() and !empty($CFG->admineditalways));
@@ -319,7 +325,7 @@
unset($SESSION->fromdiscussion);
} else if (isset($delete)) { // User is deleting a post
} else if (!empty($delete)) { // User is deleting a post
if (! $post = forum_get_post_full($delete)) {
error("Post ID was incorrect");
@@ -343,7 +349,7 @@
$replycount = forum_count_replies($post);
if (isset($confirm)) { // User has confirmed the delete
if (!empty($confirm)) { // User has confirmed the delete
if ($post->totalscore) {
notice(get_string("couldnotdeleteratings", "forum"),
@@ -419,7 +425,7 @@
die;
} else if (isset($prune)) { // Teacher is pruning
} else if (!empty($prune)) { // Teacher is pruning
if (!$post = forum_get_post_full($prune)) {
error("Post ID was incorrect");
@@ -440,7 +446,7 @@
$cm->id = 0;
}
if (isset($_GET['name'])) { // User has confirmed the prune
if (!empty($name)) { // User has confirmed the prune
$newdiscussion->course = $discussion->course;
$newdiscussion->forum = $discussion->forum;
mod/forum/rate.php
+1 -1
View File
@@ -10,7 +10,7 @@
error("Guests are not allowed to rate posts.", $_SERVER["HTTP_REFERER"]);
}
require_variable($id); // The course these ratings are part of
$id = required_param('id',PARAM_INT); // The course these ratings are part of
if (! $course = get_record("course", "id", $id)) {
error("Course ID was incorrect");
mod/forum/report.php
+1 -1
View File
@@ -5,7 +5,7 @@
require_once("../../config.php");
require_once("lib.php");
require_variable($id);
$id = required_param('id',PARAM_INT);
if (! $post = get_record("forum_posts", "id", $id)) {
error("Post ID was incorrect");
mod/forum/settracking.php
+2 -2
View File
@@ -5,8 +5,8 @@
require_once("../../config.php");
require_once("lib.php");
require_variable($id); // The forum to subscribe or unsubscribe to
optional_variable($returnpage, 'index.php'); // Page to return to.
$id = required_param('id',PARAM_INT); // The forum to subscribe or unsubscribe to
$returnpage = optional_param('returnpage', 'index.php', PARAM_FILE); // Page to return to.
if (! $forum = get_record("forum", "id", $id)) {
error("Forum ID was incorrect");
mod/forum/subscribe.php
+3 -3
View File
@@ -5,9 +5,9 @@
require_once("../../config.php");
require_once("lib.php");
require_variable($id); // The forum to subscribe or unsubscribe to
optional_variable($force); // Force everyone to be subscribed to this forum?
optional_variable($user);
$id = required_param('id',0,PARAM_INT); // The forum to subscribe or unsubscribe to
$force = optional_param('force','',PARAM_ALPHA); // Force everyone to be subscribed to this forum?
$user = optional_param('user',0,PARAM_INT);
if (! $forum = get_record("forum", "id", $id)) {
error("Forum ID was incorrect");
mod/forum/subscribers.php
+4 -5
View File
@@ -3,10 +3,9 @@
require_once("../../config.php");
require_once("lib.php");
require_variable($id); // forum
optional_variable($group); // change of group
optional_variable($edit); // Turn editing on and off
$id = required_param('id',PARAM_INT); // forum
$group = optional_param('group',0,PARAM_INT); // change of group
$edit = optional_param('edit','',PARAM_ALPHA); // Turn editing on and off
if (! $forum = get_record("forum", "id", $id)) {
error("Forum ID is incorrect");
@@ -30,7 +29,7 @@
add_to_log($course->id, "forum", "view subscribers", "subscribers.php?id=$forum->id", $forum->id, $cm->id);
if (isset($_GET['edit'])) {
if (isset_param('edit')) {
if($edit == "on") {
$USER->subscriptionsediting = true;
} else {
mod/forum/view.php
+1 -1
View File
@@ -83,7 +83,7 @@
/// Check to see if groups are being used in this forum
/// and if so, set $currentgroup to reflect the current group
$changegroup = isset($_GET['group']) ? $_GET['group'] : -1; // Group change requested?
$changegroup = isset_param('group') ? $group : -1; // Group change requested?
if ($forum->type == "teacher") {
$groupmode = NOGROUPS;