Merged from MOODLE_14_HEAD - Bug fix. Using external auth, the user account fails to be created on login if currently logged-in as guest. Credits go to Dan Marsden for the fix.

lib/moodlelib.php

@@ -91,6 +91,20 @@ define('HOURMINS', 60);
 /**
  * Parameter constants - if set then the parameter is cleaned of scripts etc
  */
+<<<<<<< moodlelib.php
+define('PARAM_RAW',     0x00);
+define('PARAM_CLEAN',   0x01);
+define('PARAM_INT',     0x02);
+define('PARAM_INTEGER', 0x02);  // Alias for PARAM_INT
+define('PARAM_ALPHA',   0x04);
+define('PARAM_ACTION',  0x04);  // Alias for PARAM_ALPHA
+define('PARAM_FORMAT',  0x04);  // Alias for PARAM_ALPHA
+define('PARAM_NOTAGS',  0x08);
+define('PARAM_FILE',    0x10);
+define('PARAM_PATH',    0x20);
+define('PARAM_HOST',    0x40);  // FQDN or IPv4 dotted quad
+
+=======
 define('PARAM_RAW',     0x0000);
 define('PARAM_CLEAN',   0x0001);
 define('PARAM_INT',     0x0002);
@@ -104,6 +118,9 @@ define('PARAM_PATH',    0x0020);
 define('PARAM_HOST',    0x0040);  // FQDN or IPv4 dotted quad
 define('PARAM_URL',     0x0080);  
 define('PARAM_LOCALURL',0x0180);  // NOT orthogonal to the others! Implies PARAM_URL!
+<<<<<<< moodlelib.php
+>>>>>>> 1.427
+=======
 define('PARAM_CLEANFILE',0x0200);
 define('PARAM_ALPHANUM',0x0400);  //numbers or letters only
 define('PARAM_BOOL',    0x0800);  //convert to value 1 or 0 using empty()
@@ -112,6 +129,7 @@ define('PARAM_BOOL',    0x0800);  //convert to value 1 or 0 using empty()
  * Definition of page types
  */
 define('PAGE_COURSE_VIEW', 'course-view');
+>>>>>>> 1.450
 
 /// PARAMETER HANDLING ////////////////////////////////////////////////////
 
@@ -236,6 +254,31 @@ function clean_param($param, $options) {
         $param = ereg_replace('/(\./)+', '/', $param);
     }
 
+<<<<<<< moodlelib.php
+    if ($options & PARAM_HOST) {         // allow FQDN or IPv4 dotted quad
+        preg_replace('/[^\.\d\w-]/','', $param ); // only allowed chars 
+	    // match ipv4 dotted quad
+        if (preg_match('/(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/',$param, $match)){
+            // confirm values are ok
+            if ( $match[0] > 255
+                 || $match[1] > 255
+                 || $match[3] > 255 
+                 || $match[4] > 255 ) {
+                // hmmm, what kind of dotted quad is this?
+                $param = '';
+            }
+        } elseif ( preg_match('/^[\w\d\.-]+$/', $param) // dots, hyphens, numbers
+                   && !preg_match('/^[\.-]/',  $param) // no leading dots/hyphens
+                   && !preg_match('/[\.-]$/',  $param) // no trailing dots/hyphens
+                   ) {
+            // all is ok - $param is respected
+        } else {
+            // all is not ok...
+            $param='';               
+        } 
+    }
+
+=======
     if ($options & PARAM_HOST) {         // allow FQDN or IPv4 dotted quad
         preg_replace('/[^\.\d\w-]/','', $param ); // only allowed chars 
         // match ipv4 dotted quad
@@ -307,6 +350,7 @@ function clean_param($param, $options) {
         }
     }
 
+>>>>>>> 1.427
     return $param;
 }
 
@@ -2035,7 +2079,7 @@ function authenticate_user_login($username, $password) {
     }
 
     if (empty($user->auth)) {      // For some reason it isn't set yet
-        if (isadmin($user->id) or isguest($user->id)) {
+        if (!empty($user->id) && (isadmin($user->id) || isguest($user->id))) {
             $auth = 'manual';    // Always assume these guys are internal
         } else {
             $auth = $CFG->auth;  // Normal users default to site method