From b3f611a14e4ba14771639ed8feccb200de4cb00a Mon Sep 17 00:00:00 2001 From: Andrew Nicols Date: Thu, 6 Oct 2022 09:05:23 +0800 Subject: [PATCH] MDL-75752 question: Bind contextid param in comment backup In source_sql, unmapped values must be bound using the backup_helper::is_sql_param() function. --- .../backup_qbank_comment_plugin.class.php | 20 +++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/question/bank/comment/backup/moodle2/backup_qbank_comment_plugin.class.php b/question/bank/comment/backup/moodle2/backup_qbank_comment_plugin.class.php index bc1a7674061..86f7d755782 100644 --- a/question/bank/comment/backup/moodle2/backup_qbank_comment_plugin.class.php +++ b/question/bank/comment/backup/moodle2/backup_qbank_comment_plugin.class.php @@ -46,14 +46,18 @@ class backup_qbank_comment_plugin extends \backup_qbank_plugin { $pluginwrapper->add_child($comments); $comments->add_child($comment); - // Trying to pass an param (contextid) with an int value seems to have special meaning, so just inline. - // It is an int, so minimal security risk. - $comment->set_source_sql("SELECT c.* - FROM {comments} c - WHERE c.contextid = " . context_system::instance()->id . " - AND c.component = 'qbank_comment' - AND c.commentarea = 'question' - AND c.itemid = ?", [backup::VAR_PARENTID]); + $comment->set_source_sql( + "SELECT c.* + FROM {comments} c + WHERE c.contextid = :contextid + AND c.component = 'qbank_comment' + AND c.commentarea = 'question' + AND c.itemid = :itemid", + [ + 'contextid' => backup_helper::is_sqlparam(context_system::instance()->id), + 'itemid' => backup::VAR_PARENTID, + ] + ); $comment->annotate_ids('user', 'userid');