From ba1c2e8d867ff08e6124d720a1331daa41d598af Mon Sep 17 00:00:00 2001
From: Paul Holden <paulh@moodle.com>
Date: Tue, 2 Aug 2022 20:55:34 +0100
Subject: [PATCH] MDL-75360 user: relax initial parameter types of external
 method.

Defer cleaning of supplied text to inside the method, so we don't
throw confusing exceptions if a user enters "unsafe" characters in
the form input.
---
 user/classes/external/search_identity.php | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/user/classes/external/search_identity.php b/user/classes/external/search_identity.php
index c92f1464913..ac66824e1ba 100644
--- a/user/classes/external/search_identity.php
+++ b/user/classes/external/search_identity.php
@@ -29,12 +29,11 @@ class search_identity extends \external_api {
     /**
      * Describes the external function parameters.
      *
-     * @return external_function_parameters
+     * @return \external_function_parameters
      */
     public static function execute_parameters(): \external_function_parameters {
-
         return new \external_function_parameters([
-            'query' => new \external_value(PARAM_TEXT, 'The search query', VALUE_REQUIRED),
+            'query' => new \external_value(PARAM_RAW, 'The search query', VALUE_REQUIRED),
         ]);
     }
 
@@ -50,7 +49,7 @@ class search_identity extends \external_api {
         $params = \external_api::validate_parameters(self::execute_parameters(), [
             'query' => $query,
         ]);
-        $query = $params['query'];
+        $query = clean_param($params['query'], PARAM_TEXT);
 
         // Validate context.
         $context = \context_system::instance();
@@ -106,7 +105,7 @@ class search_identity extends \external_api {
     /**
      * Describes the external function result value.
      *
-     * @return external_description
+     * @return \external_description
      */
     public static function execute_returns(): \external_description {