From a2ccfe79ef9281ce96dc75f3fe4cf8ec19a4bc1c Mon Sep 17 00:00:00 2001
From: Paul Holden <paulh@moodle.com>
Date: Fri, 6 Feb 2026 10:34:56 +0000
Subject: [PATCH] MDL-87874 customfield_number: validation for maximum size
 constraints.

---
 .../field/number/classes/data_controller.php  | 11 ++++++++++
 .../field/number/classes/field_controller.php | 22 +++++++++++++++++++
 .../number/tests/data_controller_test.php     |  5 ++++-
 .../number/tests/field_controller_test.php    |  1 +
 4 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/public/customfield/field/number/classes/data_controller.php b/public/customfield/field/number/classes/data_controller.php
index b5fc5eadfd6..79af8c24c85 100644
--- a/public/customfield/field/number/classes/data_controller.php
+++ b/public/customfield/field/number/classes/data_controller.php
@@ -66,7 +66,18 @@ class data_controller extends \core_customfield\data_controller {
             return;
         }
 
+        // Required for subsequent input field comparison rule.
+        $mform->addElement('hidden', "{$elementname}_maximum", SQL_INT_MAX + 1);
+        $mform->setType("{$elementname}_maximum", PARAM_INT);
+
+        // Number input field.
         $mform->addElement('float', $elementname, $this->get_field()->get_formatted_name());
+        $mform->addRule(
+            [$elementname, "{$elementname}_maximum"],
+            get_string('maximumvalueerror', 'customfield_number', SQL_INT_MAX),
+            'compare',
+            'lt',
+        );
         if (!$this->get('id')) {
             $mform->setDefault($elementname, $this->get_default_value());
         }
diff --git a/public/customfield/field/number/classes/field_controller.php b/public/customfield/field/number/classes/field_controller.php
index e4bea8259bc..956518929f4 100644
--- a/public/customfield/field/number/classes/field_controller.php
+++ b/public/customfield/field/number/classes/field_controller.php
@@ -50,20 +50,42 @@ class field_controller  extends \core_customfield\field_controller {
             }
         }
 
+        // Required for subsequent input field comparison rule.
+        $mform->addElement('hidden', "maximum", SQL_INT_MAX + 1);
+        $mform->setType("maximum", PARAM_INT);
+
         // Default value.
         $mform->addElement('float', 'configdata[defaultvalue]', get_string('defaultvalue', 'core_customfield'));
+        $mform->addRule(
+            ['configdata[defaultvalue]', 'maximum'],
+            get_string('maximumvalueerror', 'customfield_number', SQL_INT_MAX),
+            'compare',
+            'lt',
+        );
         if ($this->get_configdata_property('defaultvalue') === null) {
             $mform->setDefault('configdata[defaultvalue]', '');
         }
 
         // Minimum value.
         $mform->addElement('float', 'configdata[minimumvalue]', get_string('minimumvalue', 'customfield_number'));
+        $mform->addRule(
+            ['configdata[minimumvalue]', 'maximum'],
+            get_string('maximumvalueerror', 'customfield_number', SQL_INT_MAX),
+            'compare',
+            'lt',
+        );
         if ($this->get_configdata_property('minimumvalue') === null) {
             $mform->setDefault('configdata[minimumvalue]', '');
         }
 
         // Maximum value.
         $mform->addElement('float', 'configdata[maximumvalue]', get_string('maximumvalue', 'customfield_number'));
+        $mform->addRule(
+            ['configdata[maximumvalue]', 'maximum'],
+            get_string('maximumvalueerror', 'customfield_number', SQL_INT_MAX),
+            'compare',
+            'lt',
+        );
         if ($this->get_configdata_property('maximumvalue') === null) {
             $mform->setDefault('configdata[maximumvalue]', '');
         }
diff --git a/public/customfield/field/number/tests/data_controller_test.php b/public/customfield/field/number/tests/data_controller_test.php
index 469f41cfd64..72ced15ba6b 100644
--- a/public/customfield/field/number/tests/data_controller_test.php
+++ b/public/customfield/field/number/tests/data_controller_test.php
@@ -109,7 +109,10 @@ final class data_controller_test extends advanced_testcase {
         $category = $generator->create_category();
         $field = $generator->create_field(['categoryid' => $category->get('id'), 'type' => 'number']);
 
-        $formdata = array_merge((array) $course, ['customfield_' . $field->get('shortname') => 42]);
+        $formdata = array_merge((array) $course, [
+            'customfield_' . $field->get('shortname') => 42,
+            'customfield_' . $field->get('shortname') . '_maximum' => SQL_INT_MAX + 1,
+        ]);
         core_customfield_test_instance_form::mock_submit($formdata);
 
         $form = new core_customfield_test_instance_form('POST', ['handler' => $category->get_handler(), 'instance' => $course]);
diff --git a/public/customfield/field/number/tests/field_controller_test.php b/public/customfield/field/number/tests/field_controller_test.php
index 632dd147df5..79e339cac99 100644
--- a/public/customfield/field/number/tests/field_controller_test.php
+++ b/public/customfield/field/number/tests/field_controller_test.php
@@ -93,6 +93,7 @@ final class field_controller_test extends advanced_testcase {
         $field = $generator->create_field(['categoryid' => $category->get('id'), 'type' => 'number']);
 
         $submitdata = (array) $field->to_record();
+        $submitdata['maximum'] = SQL_INT_MAX + 1;
         $submitdata['configdata'] = array_merge($field->get('configdata'), [
             'defaultvalue' => $defaultvalue,
             'minimumvalue' => $minimumvalue,