From 3a5afbf5f165251b1bf28a9f4790f525c685c43d Mon Sep 17 00:00:00 2001 From: cescobedo Date: Sun, 7 Apr 2019 10:56:53 +0200 Subject: [PATCH] MDL-65015 core_message: add trusttext cleaning to messaging --- admin/user/user_bulk_message.php | 3 ++- lib/classes/message/message.php | 6 +++++- lib/db/install.xml | 5 +++-- lib/db/upgrade.php | 15 +++++++++++++++ lib/messagelib.php | 16 ++++++++++++++++ message/classes/api.php | 10 ++++++---- message/classes/helper.php | 6 ++++-- message/externallib.php | 19 +++++++++++++------ message/lib.php | 1 + version.php | 2 +- 10 files changed, 66 insertions(+), 17 deletions(-) mode change 100644 => 100755 lib/db/install.xml diff --git a/admin/user/user_bulk_message.php b/admin/user/user_bulk_message.php index adf90ffb356..07592178b64 100644 --- a/admin/user/user_bulk_message.php +++ b/admin/user/user_bulk_message.php @@ -4,7 +4,7 @@ require_once($CFG->libdir.'/adminlib.php'); require_once($CFG->dirroot.'/message/lib.php'); require_once('user_message_form.php'); -$msg = optional_param('msg', '', PARAM_CLEANHTML); +$msg = optional_param('msg', '', PARAM_RAW); $confirm = optional_param('confirm', 0, PARAM_BOOL); admin_externalpage_setup('userbulk'); @@ -45,6 +45,7 @@ if ($msgform->is_cancelled()) { $options->para = false; $options->newlines = true; $options->smiley = false; + $options->trusted = trusttext_trusted(\context_system::instance()); $msg = format_text($formdata->messagebody['text'], $formdata->messagebody['format'], $options); diff --git a/lib/classes/message/message.php b/lib/classes/message/message.php index 27e2edfcb32..ee2cd6045dd 100644 --- a/lib/classes/message/message.php +++ b/lib/classes/message/message.php @@ -122,6 +122,9 @@ class message { /** @var int The time the message was created.*/ private $timecreated; + /** @var boolean Mark trust content. */ + private $fullmessagetrust; + /** @var array a list of properties that is allowed for each message. */ private $properties = array( 'courseid', @@ -144,7 +147,8 @@ class message { 'savedmessageid', 'attachment', 'attachname', - 'timecreated' + 'timecreated', + 'fullmessagetrust' ); /** @var array property to store any additional message processor specific content */ diff --git a/lib/db/install.xml b/lib/db/install.xml old mode 100644 new mode 100755 index 9c127a4edce..7f7f0ec26f4 --- a/lib/db/install.xml +++ b/lib/db/install.xml @@ -1,5 +1,5 @@ - @@ -603,6 +603,7 @@ + @@ -4112,4 +4113,4 @@ - + \ No newline at end of file diff --git a/lib/db/upgrade.php b/lib/db/upgrade.php index 203e02d03a2..3e6ae7a8391 100644 --- a/lib/db/upgrade.php +++ b/lib/db/upgrade.php @@ -2934,5 +2934,20 @@ function xmldb_main_upgrade($oldversion) { upgrade_main_savepoint(true, 2019040200.01); } + if ($oldversion < 2019040600.01) { + + // Define field fullmessagetrust to be added to messages. + $table = new xmldb_table('messages'); + $field = new xmldb_field('fullmessagetrust', XMLDB_TYPE_INTEGER, '2', null, XMLDB_NOTNULL, null, '0', 'timecreated'); + + // Conditionally launch add field fullmessagetrust. + if (!$dbman->field_exists($table, $field)) { + $dbman->add_field($table, $field); + } + + // Main savepoint reached. + upgrade_main_savepoint(true, 2019040600.01); + } + return true; } diff --git a/lib/messagelib.php b/lib/messagelib.php index 95d97f238a3..2f3b4174c0b 100644 --- a/lib/messagelib.php +++ b/lib/messagelib.php @@ -154,6 +154,22 @@ function message_send(\core\message\message $eventdata) { $tabledata->smallmessage = $eventdata->smallmessage; $tabledata->timecreated = time(); + // The Trusted Content system. + // Texts created or uploaded by such users will be marked as trusted and will not be cleaned before display. + if (trusttext_active()) { + // Individual conversations are always in system context. + $messagecontext = \context_system::instance(); + // We need to know the type of conversation and the contextid if it is a group conversation. + if ($conv = $DB->get_record('message_conversations', ['id' => $conversationid], 'id, type, contextid')) { + if ($conv->type == \core_message\api::MESSAGE_CONVERSATION_TYPE_GROUP && $conv->contextid) { + $messagecontext = \context::instance_by_id($conv->contextid); + } + } + $tabledata->fullmessagetrust = trusttext_trusted($messagecontext); + } else { + $tabledata->fullmessagetrust = false; + } + if ($messageid = message_handle_phpunit_redirection($eventdata, $table, $tabledata)) { return $messageid; } diff --git a/message/classes/api.php b/message/classes/api.php index ebbb9f08143..5bcf9f147aa 100644 --- a/message/classes/api.php +++ b/message/classes/api.php @@ -549,8 +549,8 @@ class api { $typesql = !is_null($type) ? " AND mc.type = :convtype " : ""; $sql = "SELECT m.id as messageid, mc.id as id, mc.name as conversationname, mc.type as conversationtype, m.useridfrom, - m.smallmessage, m.fullmessage, m.fullmessageformat, m.fullmessagehtml, m.timecreated, mc.component, - mc.itemtype, mc.itemid, mc.contextid, mca.action as ismuted + m.smallmessage, m.fullmessage, m.fullmessageformat, m.fullmessagetrust, m.fullmessagehtml, m.timecreated, + mc.component, mc.itemtype, mc.itemid, mc.contextid, mca.action as ismuted FROM {message_conversations} mc INNER JOIN {message_conversation_members} mcm ON (mcm.conversationid = mc.id AND mcm.userid = :userid3) @@ -1917,12 +1917,14 @@ class api { $eventdata->notification = 0; $messageid = message_send($eventdata); - $messagerecord = $DB->get_record('messages', ['id' => $messageid], 'id, useridfrom, fullmessage, timecreated'); + $messagerecord = $DB->get_record('messages', ['id' => $messageid], 'id, useridfrom, fullmessage, + timecreated, fullmessagetrust'); $message = (object) [ 'id' => $messagerecord->id, 'useridfrom' => $messagerecord->useridfrom, 'text' => $messagerecord->fullmessage, - 'timecreated' => $messagerecord->timecreated + 'timecreated' => $messagerecord->timecreated, + 'fullmessagetrust' => $messagerecord->fullmessagetrust ]; return $message; } diff --git a/message/classes/helper.php b/message/classes/helper.php index 80727c3988a..a1099b9d4bb 100644 --- a/message/classes/helper.php +++ b/message/classes/helper.php @@ -58,7 +58,8 @@ class helper { $hash = self::get_conversation_hash([$userid, $otheruserid]); $sql = "SELECT m.id, m.useridfrom, m.subject, m.fullmessage, m.fullmessagehtml, - m.fullmessageformat, m.smallmessage, m.timecreated, muaread.timecreated AS timeread + m.fullmessageformat, m.fullmessagetrust, m.smallmessage, m.timecreated, + mc.contextid, muaread.timecreated AS timeread FROM {message_conversations} mc INNER JOIN {messages} m ON m.conversationid = mc.id @@ -131,7 +132,8 @@ class helper { global $DB; $sql = "SELECT m.id, m.useridfrom, m.subject, m.fullmessage, m.fullmessagehtml, - m.fullmessageformat, m.smallmessage, m.timecreated, muaread.timecreated AS timeread + m.fullmessageformat, m.fullmessagetrust, m.smallmessage, m.timecreated, + mc.contextid, muaread.timecreated AS timeread FROM {message_conversations} mc INNER JOIN {messages} m ON m.conversationid = mc.id diff --git a/message/externallib.php b/message/externallib.php index 9d107601709..7535be912ab 100644 --- a/message/externallib.php +++ b/message/externallib.php @@ -94,7 +94,8 @@ class core_message_external extends external_api { $message['textformat']); $createdmessage->text = message_format_message_text((object) [ 'smallmessage' => $createdmessage->text, - 'fullmessageformat' => external_validate_format($message['textformat']) + 'fullmessageformat' => external_validate_format($message['textformat']), + 'fullmessagetrust' => $createdmessage->fullmessagetrust ]); $messages[] = $createdmessage; } @@ -203,10 +204,6 @@ class core_message_external extends external_api { } if ($success) { $resultmsg['msgid'] = $success; - $resultmsg['text'] = message_format_message_text((object) [ - 'smallmessage' => $message['text'], - 'fullmessageformat' => external_validate_format($message['textformat']) - ]); $resultmsg['timecreated'] = time(); $messageids[] = $success; } else { @@ -221,11 +218,21 @@ class core_message_external extends external_api { } if (!empty($messageids)) { - $messagerecords = $DB->get_records_list('messages', 'id', $messageids, '', 'id, conversationid'); + $messagerecords = $DB->get_records_list( + 'messages', + 'id', + $messageids, + '', + 'id, conversationid, smallmessage, fullmessageformat, fullmessagetrust'); $resultmessages = array_map(function($resultmessage) use ($messagerecords, $USER) { $id = $resultmessage['msgid']; $resultmessage['conversationid'] = isset($messagerecords[$id]) ? $messagerecords[$id]->conversationid : null; $resultmessage['useridfrom'] = $USER->id; + $resultmessage['text'] = message_format_message_text((object) [ + 'smallmessage' => $messagerecords[$id]->smallmessage, + 'fullmessageformat' => external_validate_format($messagerecords[$id]->fullmessageformat), + 'fullmessagetrust' => $messagerecords[$id]->fullmessagetrust + ]); return $resultmessage; }, $resultmessages); } diff --git a/message/lib.php b/message/lib.php index 759a50f9018..b98190fa073 100644 --- a/message/lib.php +++ b/message/lib.php @@ -114,6 +114,7 @@ function message_format_message_text($message, $forcetexttohtml = false) { $options = new stdClass(); $options->para = false; $options->blanktarget = true; + $options->trusted = isset($message->fullmessagetrust) ? $message->fullmessagetrust : false; $format = $message->fullmessageformat; diff --git a/version.php b/version.php index 08fe4374e63..5017af85b91 100644 --- a/version.php +++ b/version.php @@ -29,7 +29,7 @@ defined('MOODLE_INTERNAL') || die(); -$version = 2019040600.00; // YYYYMMDD = weekly release date of this DEV branch. +$version = 2019040600.01; // YYYYMMDD = weekly release date of this DEV branch. // RR = release increments - 00 in DEV branches. // .XX = incremental changes.