L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-72249 message: stricter cleaning of processor type parameter.

Browse Source
This commit is contained in:
Paul Holden
2023-10-04 02:05:15 +02:00
committed by Jenkins
parent 42fb4b1a6c
commit ce38fda651
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
message/externallib.php
+2 -2
View File
@@ -2845,7 +2845,7 @@ class core_message_external extends external_api {
return new external_function_parameters(
array(
'userid' => new external_value(PARAM_INT, 'id of the user, 0 for current user', VALUE_REQUIRED),
'name' => new external_value(PARAM_TEXT, 'The name of the message processor'),
'name' => new external_value(PARAM_SAFEDIR, 'The name of the message processor'),
'formvalues' => new external_multiple_structure(
new external_single_structure(
array(
@@ -2921,7 +2921,7 @@ class core_message_external extends external_api {
return new external_function_parameters(
array(
'userid' => new external_value(PARAM_INT, 'id of the user, 0 for current user'),
'name' => new external_value(PARAM_TEXT, 'The name of the message processor', VALUE_REQUIRED),
'name' => new external_value(PARAM_SAFEDIR, 'The name of the message processor', VALUE_REQUIRED),
)
);
}
message/lib.php
+2 -2
View File
@@ -734,8 +734,8 @@ function message_output_fragment_processor_settings($args = []) {
throw new moodle_exception('Must provide a userid');
}
$type = $args['type'];
$userid = $args['userid'];
$type = clean_param($args['type'], PARAM_SAFEDIR);
$userid = clean_param($args['userid'], PARAM_INT);
$user = core_user::get_user($userid, '*', MUST_EXIST);
if (!core_message_can_edit_message_profile($user)) {