From 8d73532067fe5f0848d843ea70eefb9e5f7abe24 Mon Sep 17 00:00:00 2001
From: stronk7 <stronk7>
Date: Wed, 6 May 2009 10:16:54 +0000
Subject: [PATCH] MDL-18059 database rates - secured

---
 lang/en_utf8/data.php | 1 +
 mod/data/rate.php     | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/lang/en_utf8/data.php b/lang/en_utf8/data.php
index 3479dd7df18..2ee7133efb7 100644
--- a/lang/en_utf8/data.php
+++ b/lang/en_utf8/data.php
@@ -131,6 +131,7 @@ $string['importsuccess'] = 'The preset has been successfully applied.';
 $string['insufficiententries'] = 'more entries needed to view this database';
 $string['intro'] = 'Introduction';
 $string['invalidfieldname'] = 'Please choose another name for this field';
+$string['invalidrate'] = 'Invalid database rate ($a)';
 $string['invalidurl'] = 'The URL you just entered is not valid';
 $string['jstemplate'] = 'Javascript template';
 $string['latitude'] = 'Latitude';
diff --git a/mod/data/rate.php b/mod/data/rate.php
index e756de4878a..c0850f3877b 100755
--- a/mod/data/rate.php
+++ b/mod/data/rate.php
@@ -33,6 +33,9 @@
         error("This page was not accessed correctly");
     }
 
+/// Calculate scale values
+    $scale_values = make_grades_menu($data->scale);
+
     $count = 0;
 
     foreach ((array)$frmdata as $recordid => $rating) {
@@ -52,6 +55,11 @@
             continue;
         }
 
+    /// Check rate is valid for that database scale values
+        if (!array_key_exists($rating, $scale_values) && $rating != -999) {
+            print_error('invalidrate', 'data', '', $rating);
+        }
+
         // input validation ok
 
         $count++;