From ffd3e38977685ae119bd00d05383c81a01ad0c48 Mon Sep 17 00:00:00 2001 From: Marina Glancy Date: Thu, 7 Jul 2011 15:23:29 +0800 Subject: [PATCH 1/2] MDL-28197 adding slashes to group name when creating group in user upload --- admin/uploaduser.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/admin/uploaduser.php b/admin/uploaduser.php index 52834a5e801..f74967c74ab 100755 --- a/admin/uploaduser.php +++ b/admin/uploaduser.php @@ -665,7 +665,7 @@ if ($formdata = $mform->is_cancelled()) { $newgroupdata = new object(); $newgroupdata->name = $addgroup; $newgroupdata->courseid = $ccache[$shortname]->id; - if ($ccache[$shortname]->groups[$addgroup]->id = groups_create_group($newgroupdata)){ + if ($ccache[$shortname]->groups[$addgroup]->id = groups_create_group(addslashes_recursive($newgroupdata))){ $ccache[$shortname]->groups[$addgroup]->name = $newgroupdata->name; } else { $upt->track('enrolments', get_string('unknowngroup', 'error', $addgroup), 'error'); From 682e430ce090058889f219607711e09c634e9e90 Mon Sep 17 00:00:00 2001 From: Marina Glancy Date: Fri, 8 Jul 2011 10:10:41 +0800 Subject: [PATCH 2/2] MDL-28197 another possible sql vulnerability injection fixed --- admin/uploaduser.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/admin/uploaduser.php b/admin/uploaduser.php index f74967c74ab..f917566f58c 100755 --- a/admin/uploaduser.php +++ b/admin/uploaduser.php @@ -558,7 +558,7 @@ if ($formdata = $mform->is_cancelled()) { continue; } // save custom profile fields data - profile_save_data($user); + profile_save_data(addslashes_recursive($user)); // make sure user context exists get_context_instance(CONTEXT_USER, $user->id);