From 70e3da07fd461f7e384236cd51848749f6a826aa Mon Sep 17 00:00:00 2001 From: thepurpleblob Date: Fri, 10 Jun 2005 19:54:41 +0000 Subject: [PATCH] Changed all optional_variable() and require_variable() to equivalent optional_param() and required_param() for greater security. --- mod/forum/discuss.php | 12 ++++++------ mod/forum/index.php | 2 +- mod/forum/markposts.php | 8 ++++---- mod/forum/post.php | 18 ++++++++++++------ mod/forum/rate.php | 2 +- mod/forum/report.php | 2 +- mod/forum/settracking.php | 4 ++-- mod/forum/subscribe.php | 6 +++--- mod/forum/subscribers.php | 9 ++++----- mod/forum/view.php | 2 +- 10 files changed, 35 insertions(+), 30 deletions(-) diff --git a/mod/forum/discuss.php b/mod/forum/discuss.php index feb0d2af4a1..9d26a49ff79 100644 --- a/mod/forum/discuss.php +++ b/mod/forum/discuss.php @@ -6,12 +6,12 @@ require_once("../../config.php"); require_once("lib.php"); - require_variable($d); // Discussion ID - optional_variable($parent); // If set, then display this post and all children. - optional_variable($mode); // If set, changes the layout of the thread - optional_variable($move); // If set, moves this discussion to another forum - optional_variable($mark); // Used for tracking read posts if user initiated. - optional_variable($postid); // Used for tracking read posts if user initiated. + $d = required_param('d',PARAM_INT); // Discussion ID + $parent = optional_param('parent',0,PARAM_INT); // If set, then display this post and all children. + $mode = optional_param('mode',0,PARAM_INT); // If set, changes the layout of the thread + $move = optional_param('move',0,PARAM_INT); // If set, moves this discussion to another forum + $mark = optional_param('mark',0,PARAM_INT); // Used for tracking read posts if user initiated. + $postid = optional_param('postid',0,PARAM_INT); // Used for tracking read posts if user initiated. if (! $discussion = get_record("forum_discussions", "id", $d)) { error("Discussion ID was incorrect or no longer exists"); diff --git a/mod/forum/index.php b/mod/forum/index.php index 1d3f19cc312..f76448e9ac1 100644 --- a/mod/forum/index.php +++ b/mod/forum/index.php @@ -4,7 +4,7 @@ require_once("lib.php"); require_once("$CFG->libdir/rsslib.php"); - optional_variable($id); // course + $id = optional_param('id',0,PARAM_INT); // course if ($id) { if (! $course = get_record("course", "id", $id)) { diff --git a/mod/forum/markposts.php b/mod/forum/markposts.php index b1b00997dc3..45cb80f3353 100644 --- a/mod/forum/markposts.php +++ b/mod/forum/markposts.php @@ -5,10 +5,10 @@ require_once("../../config.php"); require_once("lib.php"); - require_variable($f); // The forum to mark - require_variable($mark); // Read or unread? - optional_variable($d); // Discussion to mark. - optional_variable($returnpage, 'index.php'); // Page to return to. + $f = required_param('f',PARAM_INT); // The forum to mark + $mark = required_param('mark',PARAM_ALPHA); // Read or unread? + $d = optional_param('d',0,PARAM_INT); // Discussion to mark. + $returnpage = optional_param('returnpage', 'index.php', PARAM_FILE); // Page to return to. if (! $forum = get_record("forum", "id", $f)) { error("Forum ID was incorrect"); diff --git a/mod/forum/post.php b/mod/forum/post.php index ee98761df84..b4aee2306dd 100644 --- a/mod/forum/post.php +++ b/mod/forum/post.php @@ -6,6 +6,12 @@ require_once('lib.php'); $reply = optional_param('reply', 0, PARAM_INT); + $forum = optional_param('forum', 0, PARAM_INT); + $edit = optional_param('edit', 0, PARAM_INT); + $delete = optional_param('delete', 0, PARAM_INT); + $prune = optional_param('prune',0,PARAM_INT); + $name = optional_param('name','',PARAM_CLEAN); + $confirm = optional_param('confirm',0,PARAM_INT); if (isguest()) { $wwwroot = $CFG->wwwroot.'/login/index.php'; @@ -193,7 +199,7 @@ } } - } else if (isset($forum)) { // User is starting a new discussion in a forum + } else if (!empty($forum)) { // User is starting a new discussion in a forum $SESSION->fromurl = $_SERVER["HTTP_REFERER"]; @@ -281,7 +287,7 @@ unset($SESSION->fromdiscussion); - } else if (isset($edit)) { // User is editing their own post + } else if (!empty($edit)) { // User is editing their own post $adminedit = (isadmin() and !empty($CFG->admineditalways)); @@ -319,7 +325,7 @@ unset($SESSION->fromdiscussion); - } else if (isset($delete)) { // User is deleting a post + } else if (!empty($delete)) { // User is deleting a post if (! $post = forum_get_post_full($delete)) { error("Post ID was incorrect"); @@ -343,7 +349,7 @@ $replycount = forum_count_replies($post); - if (isset($confirm)) { // User has confirmed the delete + if (!empty($confirm)) { // User has confirmed the delete if ($post->totalscore) { notice(get_string("couldnotdeleteratings", "forum"), @@ -419,7 +425,7 @@ die; - } else if (isset($prune)) { // Teacher is pruning + } else if (!empty($prune)) { // Teacher is pruning if (!$post = forum_get_post_full($prune)) { error("Post ID was incorrect"); @@ -440,7 +446,7 @@ $cm->id = 0; } - if (isset($_GET['name'])) { // User has confirmed the prune + if (!empty($name)) { // User has confirmed the prune $newdiscussion->course = $discussion->course; $newdiscussion->forum = $discussion->forum; diff --git a/mod/forum/rate.php b/mod/forum/rate.php index 990f5c6c7a4..308c3bf3edf 100644 --- a/mod/forum/rate.php +++ b/mod/forum/rate.php @@ -10,7 +10,7 @@ error("Guests are not allowed to rate posts.", $_SERVER["HTTP_REFERER"]); } - require_variable($id); // The course these ratings are part of + $id = required_param('id',PARAM_INT); // The course these ratings are part of if (! $course = get_record("course", "id", $id)) { error("Course ID was incorrect"); diff --git a/mod/forum/report.php b/mod/forum/report.php index 5f07d0c6ecf..09f1f8f0eae 100644 --- a/mod/forum/report.php +++ b/mod/forum/report.php @@ -5,7 +5,7 @@ require_once("../../config.php"); require_once("lib.php"); - require_variable($id); + $id = required_param('id',PARAM_INT); if (! $post = get_record("forum_posts", "id", $id)) { error("Post ID was incorrect"); diff --git a/mod/forum/settracking.php b/mod/forum/settracking.php index 1f774e08b08..111452b0da2 100644 --- a/mod/forum/settracking.php +++ b/mod/forum/settracking.php @@ -5,8 +5,8 @@ require_once("../../config.php"); require_once("lib.php"); - require_variable($id); // The forum to subscribe or unsubscribe to - optional_variable($returnpage, 'index.php'); // Page to return to. + $id = required_param('id',PARAM_INT); // The forum to subscribe or unsubscribe to + $returnpage = optional_param('returnpage', 'index.php', PARAM_FILE); // Page to return to. if (! $forum = get_record("forum", "id", $id)) { error("Forum ID was incorrect"); diff --git a/mod/forum/subscribe.php b/mod/forum/subscribe.php index 09bbae455b1..455f77a5dff 100644 --- a/mod/forum/subscribe.php +++ b/mod/forum/subscribe.php @@ -5,9 +5,9 @@ require_once("../../config.php"); require_once("lib.php"); - require_variable($id); // The forum to subscribe or unsubscribe to - optional_variable($force); // Force everyone to be subscribed to this forum? - optional_variable($user); + $id = required_param('id',0,PARAM_INT); // The forum to subscribe or unsubscribe to + $force = optional_param('force','',PARAM_ALPHA); // Force everyone to be subscribed to this forum? + $user = optional_param('user',0,PARAM_INT); if (! $forum = get_record("forum", "id", $id)) { error("Forum ID was incorrect"); diff --git a/mod/forum/subscribers.php b/mod/forum/subscribers.php index 2f7ecde0711..db01a7c5b13 100644 --- a/mod/forum/subscribers.php +++ b/mod/forum/subscribers.php @@ -3,10 +3,9 @@ require_once("../../config.php"); require_once("lib.php"); - require_variable($id); // forum - optional_variable($group); // change of group - - optional_variable($edit); // Turn editing on and off + $id = required_param('id',PARAM_INT); // forum + $group = optional_param('group',0,PARAM_INT); // change of group + $edit = optional_param('edit','',PARAM_ALPHA); // Turn editing on and off if (! $forum = get_record("forum", "id", $id)) { error("Forum ID is incorrect"); @@ -30,7 +29,7 @@ add_to_log($course->id, "forum", "view subscribers", "subscribers.php?id=$forum->id", $forum->id, $cm->id); - if (isset($_GET['edit'])) { + if (isset_param('edit')) { if($edit == "on") { $USER->subscriptionsediting = true; } else { diff --git a/mod/forum/view.php b/mod/forum/view.php index d65be527018..4f75718b4e4 100644 --- a/mod/forum/view.php +++ b/mod/forum/view.php @@ -83,7 +83,7 @@ /// Check to see if groups are being used in this forum /// and if so, set $currentgroup to reflect the current group - $changegroup = isset($_GET['group']) ? $_GET['group'] : -1; // Group change requested? + $changegroup = isset_param('group') ? $group : -1; // Group change requested? if ($forum->type == "teacher") { $groupmode = NOGROUPS;