L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-75752 question: Bind contextid param in comment backup

Browse Source 
In source_sql, unmapped values must be bound using the
backup_helper::is_sql_param() function.
This commit is contained in:
Andrew Nicols
2022-10-06 09:07:42 +08:00
parent e3b8864cc4
commit b3f611a14e
1 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
question/bank/comment/backup/moodle2/backup_qbank_comment_plugin.class.php
+12 -8
View File
@@ -46,14 +46,18 @@ class backup_qbank_comment_plugin extends \backup_qbank_plugin {
$pluginwrapper->add_child($comments);
$comments->add_child($comment);
// Trying to pass an param (contextid) with an int value seems to have special meaning, so just inline.
// It is an int, so minimal security risk.
$comment->set_source_sql("SELECT c.*
FROM {comments} c
WHERE c.contextid = " . context_system::instance()->id . "
AND c.component = 'qbank_comment'
AND c.commentarea = 'question'
AND c.itemid = ?", [backup::VAR_PARENTID]);
$comment->set_source_sql(
"SELECT c.*
FROM {comments} c
WHERE c.contextid = :contextid
AND c.component = 'qbank_comment'
AND c.commentarea = 'question'
AND c.itemid = :itemid",
[
'contextid' => backup_helper::is_sqlparam(context_system::instance()->id),
'itemid' => backup::VAR_PARENTID,
]
);
$comment->annotate_ids('user', 'userid');