MDL-18059 database rates - secured

mod/data/rate.php

@@ -33,6 +33,9 @@
         error("This page was not accessed correctly");
     }
 
+/// Calculate scale values
+    $scale_values = make_grades_menu($data->scale);
+
     $count = 0;
 
     foreach ((array)$frmdata as $recordid => $rating) {
@@ -52,6 +55,11 @@
             continue;
         }
 
+    /// Check rate is valid for that database scale values
+        if (!array_key_exists($rating, $scale_values) && $rating != -999) {
+            print_error('invalidrate', 'data', '', $rating);
+        }
+
         // input validation ok
 
         $count++;