From aee963dac8f648fefcf539a99f2dfdbab6774146 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20S=CC=8Ckoda?= Date: Fri, 27 Jul 2012 18:44:41 +0200 Subject: [PATCH] MDL-34538 fix PARAM_FLOAT validation --- lib/moodlelib.php | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/lib/moodlelib.php b/lib/moodlelib.php index cea6c4f8e7b..fb28488fdf2 100644 --- a/lib/moodlelib.php +++ b/lib/moodlelib.php @@ -655,7 +655,8 @@ function optional_param_array($parname, $default, $type) { * @param string $type PARAM_ constant * @param bool $allownull are nulls valid value? * @param string $debuginfo optional debug information - * @return mixed the $param value converted to PHP type or invalid_parameter_exception + * @return mixed the $param value converted to PHP type + * @throws invalid_parameter_exception if $param is not of given type */ function validate_param($param, $type, $allownull=NULL_NOT_ALLOWED, $debuginfo='') { if (is_null($param)) { @@ -670,7 +671,15 @@ function validate_param($param, $type, $allownull=NULL_NOT_ALLOWED, $debuginfo=' } $cleaned = clean_param($param, $type); - if ((string)$param !== (string)$cleaned) { + + if ($type == PARAM_FLOAT) { + // Do not detect precision loss here. + if (is_float($param) or is_int($param)) { + // These always fit. + } else if (!is_numeric($param) or !preg_match('/^[\+-]?[0-9]*\.?[0-9]*(e[-+]?[0-9]+)?$/i', (string)$param)) { + throw new invalid_parameter_exception($debuginfo); + } + } else if ((string)$param !== (string)$cleaned) { // conversion to string is usually lossless throw new invalid_parameter_exception($debuginfo); }