From c9c6dbebd68f1125426e73f0ce3aeedf0f3dd01b Mon Sep 17 00:00:00 2001
From: Paul Holden <paulh@moodle.com>
Date: Thu, 13 Mar 2025 10:00:52 +0000
Subject: [PATCH] MDL-84865 cohort: improve system report validation of
 parameters.

---
 .../local/systemreports/cohorts.php           | 30 +++++++------------
 cohort/index.php                              |  3 +-
 2 files changed, 12 insertions(+), 21 deletions(-)

diff --git a/cohort/classes/reportbuilder/local/systemreports/cohorts.php b/cohort/classes/reportbuilder/local/systemreports/cohorts.php
index 305e1a86466..7d8566b06ba 100644
--- a/cohort/classes/reportbuilder/local/systemreports/cohorts.php
+++ b/cohort/classes/reportbuilder/local/systemreports/cohorts.php
@@ -55,11 +55,11 @@ class cohorts extends system_report {
             "{$entitymainalias}.component");
 
         // Check if report needs to show a specific category.
-        $contextid = $this->get_parameter('contextid', 0, PARAM_INT);
-        $showall = $this->get_parameter('showall', true, PARAM_BOOL);
-        if (!$showall) {
+        if (!$this->get_context() instanceof context_system || !$this->get_parameter('showall', false, PARAM_BOOL)) {
             $paramcontextid = database::generate_param_name();
-            $this->add_base_condition_sql("{$entitymainalias}.contextid = :$paramcontextid", [$paramcontextid => $contextid]);
+            $this->add_base_condition_sql("{$entitymainalias}.contextid = :{$paramcontextid}", [
+                $paramcontextid => $this->get_context()->id,
+            ]);
         }
 
         // Now we can call our helper methods to add the content we want to include in the report.
@@ -77,14 +77,7 @@ class cohorts extends system_report {
      * @return bool
      */
     protected function can_view(): bool {
-        $contextid = $this->get_parameter('contextid', 0, PARAM_INT);
-        if ($contextid) {
-            $context = context::instance_by_id($contextid, MUST_EXIST);
-        } else {
-            $context = context_system::instance();
-        }
-
-        return has_any_capability(['moodle/cohort:manage', 'moodle/cohort:view'], $context);
+        return has_any_capability(['moodle/cohort:manage', 'moodle/cohort:view'], $this->get_context());
     }
 
     /**
@@ -98,10 +91,8 @@ class cohorts extends system_report {
     public function add_columns(cohort $cohortentity): void {
 
         $entitymainalias = $cohortentity->get_table_alias('cohort');
-        $showall = $this->get_parameter('showall', false, PARAM_BOOL);
-
         // Category column. An extra callback is appended in order to extend the current column formatting.
-        if ($showall) {
+        if ($this->get_context() instanceof context_system && $this->get_parameter('showall', false, PARAM_BOOL)) {
             $this->add_column_from_entity('cohort:context')
                 ->add_callback(static function(string $value, stdClass $cohort): string {
                     $context = context::instance_by_id($cohort->contextid);
@@ -195,10 +186,11 @@ class cohorts extends system_report {
      */
     protected function add_actions(): void {
 
-        $contextid = $this->get_parameter('contextid', 0, PARAM_INT);
-        $showall = $this->get_parameter('showall', true, PARAM_BOOL);
-        $returnurl = (new moodle_url('/cohort/index.php',
-            ['id' => ':id', 'contextid' => $contextid, 'showall' => $showall]))->out(false);
+        $returnurl = (new moodle_url('/cohort/index.php', [
+            'id' => ':id',
+            'contextid' => $this->get_context()->id,
+            'showall' => $this->get_parameter('showall', false, PARAM_BOOL),
+        ]))->out(false);
 
         // Hide action. It will be only shown if the property 'visible' is true and user has 'moodle/cohort:manage' capabillity.
         $this->add_action((new action(
diff --git a/cohort/index.php b/cohort/index.php
index 9b40c5db09c..8c039999ef5 100644
--- a/cohort/index.php
+++ b/cohort/index.php
@@ -104,8 +104,7 @@ if ($editcontrols = cohort_edit_controls($context, $baseurl)) {
     echo $OUTPUT->render($editcontrols);
 }
 
-$reportparams = ['contextid' => $context->id, 'showall' => $showall];
-$report = system_report_factory::create(cohorts::class, $context, '', '', 0, $reportparams);
+$report = system_report_factory::create(cohorts::class, $context, '', '', 0, ['showall' => $showall]);
 
 // Check if it needs to search by name.
 if (!empty($searchquery)) {