L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security related parameter cleanup in workshop code, please test it. No bug fixes...

Browse Source
This commit is contained in:
skodak
2006-04-19 19:48:46 +00:00
parent 7282d18cf0
commit d2963541e2
6 changed files with 47 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod/workshop/assess.php
+5 -5
View File
@@ -4,11 +4,11 @@
require("lib.php");
require("locallib.php");
$id = required_param('id',PARAM_INT); // Submission ID
$allowcomments = optional_param('allowcomments', false);
$redirect = optional_param('redirect', '');
$frameset = optional_param('frameset','',PARAM_ALPHA);
$sid = optional_param('sid',0,PARAM_INT);
$id = required_param('id', PARAM_INT); // Submission ID
$allowcomments = optional_param('allowcomments', 0, PARAM_BOOL);
$redirect = optional_param('redirect', '', PARAM_URL);
$frameset = optional_param('frameset', '', PARAM_ALPHA);
$sid = optional_param('sid', 0, PARAM_INT);
if (! $submission = get_record('workshop_submissions', 'id', $sid)) {
error("Incorrect submission id");
mod/workshop/assessments.php
+19 -19
View File
@@ -30,15 +30,15 @@
require("lib.php");
require("locallib.php");
$id = optional_param('id', 0, PARAM_INT); // Course Module ID
$wid = optional_param('wid', 0, PARAM_INT); // Workshop ID
$aid = optional_param('aid',0,PARAM_INT);
$userid = optional_param('userid',0,PARAM_INT);
$cid = optional_param('cid',0,PARAM_INT ); // comment id
$sid = optional_param('sid',0,PARAM_INT); // submission id
$action = required_param( 'action',PARAM_ALPHA );
$elementno = optional_param( 'elementno',-1,PARAM_INT );
$stockcommentid = optional_param( 'stockcommentid',0,PARAM_INT );
$action = required_param('action', PARAM_ALPHA);
$id = optional_param('id', 0, PARAM_INT); // Course Module ID
$wid = optional_param('wid', 0, PARAM_INT); // Workshop ID
$aid = optional_param('aid', 0, PARAM_INT);
$userid = optional_param('userid', 0, PARAM_INT);
$cid = optional_param('cid', 0, PARAM_INT ); // comment id
$sid = optional_param('sid', 0, PARAM_INT); // submission id
$elementno = optional_param('elementno', -1, PARAM_INT);
$stockcommentid = optional_param('stockcommentid', 0, PARAM_INT);
// get some useful stuff...
if ($id) {
@@ -84,7 +84,7 @@
print_heading_with_help(get_string("addacomment", "workshop"), "addingacomment", "workshop");
// get assessment record
if (!$assessmentid = $_REQUEST['aid']) { // comes from link or hidden form variable
if (!$assessmentid = $aid) { // comes from link or hidden form variable
error("Assessment id not given");
}
$assessment = get_record("workshop_assessments", "id", $assessmentid);
@@ -95,7 +95,7 @@
<form name="commentform" action="assessments.php" method="post">
<input type="hidden" name="action" value="insertcomment" />
<input type="hidden" name="id" value="<?php echo $cm->id ?>" />
<input type="hidden" name="aid" value="<?php echo $_REQUEST['aid'] ?>" />
<input type="hidden" name="aid" value="<?php echo $aid ?>" />
<center>
<table cellpadding="5" border="1">
<?php
@@ -195,7 +195,7 @@
unset($element);
$element->workshopid = $workshop->id;
$element->assessmentid = $assessment->id;
$element->elementno = $key;
$element->elementno = clean_param($key, PARAM_INT);
$element->feedback = $form->{"feedback_$key"};
$element->grade = $thegrade;
if (!$element->id = insert_record("workshop_grades", $element)) {
@@ -282,7 +282,7 @@
unset($element);
$element->workshopid = $workshop->id;
$element->assessmentid = $assessment->id;
$element->elementno = $key;
$element->elementno = clean_param($key, PARAM_INT);
$element->feedback = $form->{"feedback_$key"};
$element->grade = $thegrade;
if (!$element->id = insert_record("workshop_grades", $element)) {
@@ -737,7 +737,7 @@
unset($element);
$element->description = $description;
$element->workshopid = $workshop->id;
$element->elementno = $key;
$element->elementno = clean_param($key, PARAM_INT);
if (isset($form->scale[$key])) {
$element->scale = $form->scale[$key];
switch ($WORKSHOP_SCALES[$form->scale[$key]]['type']) {
@@ -763,7 +763,7 @@
foreach ($form->maxscore as $key => $themaxscore) {
unset($element);
$element->workshopid = $workshop->id;
$element->elementno = $key;
$element->elementno = clean_param($key, PARAM_INT);
$element->maxscore = $themaxscore;
if (isset($form->description[$key])) {
$element->description = $form->description[$key];
@@ -782,7 +782,7 @@
foreach ($form->description as $key => $description) {
unset($element);
$element->workshopid = $workshop->id;
$element->elementno = $key;
$element->elementno = clean_param($key, PARAM_INT);
$element->description = $description;
$element->weight = $form->weight[$key];
for ($j=0;$j<5;$j++) {
@@ -936,7 +936,7 @@
unset($element);
$element->workshopid = $workshop->id;
$element->assessmentid = $assessment->id;
$element->elementno = $key;
$element->elementno = clean_param($key, PARAM_INT);
$element->feedback = $form->{"feedback_$key"};
$element->grade = $thegrade;
if (!$element->id = insert_record("workshop_grades", $element)) {
@@ -1023,7 +1023,7 @@
unset($element);
$element->workshopid = $workshop->id;
$element->assessmentid = $assessment->id;
$element->elementno = $key;
$element->elementno = clean_param($key, PARAM_INT);
$element->feedback = $form->{"feedback_$key"};
$element->grade = $thegrade;
if (!$element->id = insert_record("workshop_grades", $element)) {
@@ -1200,7 +1200,7 @@
unset($element);
$element->workshopid = $workshop->id;
$element->assessmentid = $assessment->id;
$element->elementno = $key;
$element->elementno = clean_param($key, PARAM_INT);
$element->feedback = $form->{"feedback_$key"};
$element->grade = $thegrade;
if (!$element->id = insert_record("workshop_grades", $element)) {
mod/workshop/submissions.php
+8 -8
View File
@@ -21,14 +21,14 @@
require("lib.php");
require("locallib.php");
$id = required_param('id',PARAM_INT); // Course Module ID
$action = optional_param('action','',PARAM_ALPHA);
$sid = optional_param('sid',0,PARAM_INT); //submission id
$order = optional_param('order','name',PARAM_ALPHA);
$title = optional_param('title','',PARAM_CLEAN);
$nentries = optional_param('nentries','',PARAM_ALPHANUM);
$anonymous = optional_param('anonymous','',PARAM_CLEAN);
$description = optional_param('description','',PARAM_CLEAN);
$id = required_param('id', PARAM_INT); // Course Module ID
$action = optional_param('action', '', PARAM_ALPHA);
$sid = optional_param('sid', 0, PARAM_INT); //submission id
$order = optional_param('order', 'name', PARAM_ALPHA);
$title = optional_param('title', '', PARAM_CLEAN);
$nentries = optional_param('nentries', '', PARAM_ALPHANUM);
$anonymous = optional_param('anonymous', '', PARAM_CLEAN);
$description = optional_param('description', '', PARAM_CLEAN);
$timenow = time();
mod/workshop/upload.php
+6 -6
View File
@@ -4,7 +4,7 @@
require("lib.php");
require("locallib.php");
$id = required_param('id',PARAM_INT); // CM ID
$id = required_param('id', PARAM_INT); // CM ID
if (! $cm = get_record("course_modules", "id", $id)) {
@@ -55,11 +55,11 @@
// get the current set of submissions
$submissions = workshop_get_user_submissions($workshop, $USER);
// add new submission record
$newsubmission->workshopid = $workshop->id;
$newsubmission->userid = $USER->id;
$newsubmission->title = $title;
$newsubmission->description = trim($form->description);
$newsubmission->timecreated = $timenow;
$newsubmission->workshopid = $workshop->id;
$newsubmission->userid = $USER->id;
$newsubmission->title = clean_param($title, PARAM_CLEAN);
$newsubmission->description = trim(clean_param($form->description, PARAM_CLEAN));
$newsubmission->timecreated = $timenow;
if ($timenow > $workshop->submissionend) {
$newsubmission->late = 1;
}
mod/workshop/view.php
+5 -5
View File
@@ -17,11 +17,11 @@
require("lib.php");
require("locallib.php");
$id = required_param('id',PARAM_INT); // Course Module ID
$action = optional_param('action', '',PARAM_ALPHA);
$sort = optional_param('sort', 'lastname');
$dir = optional_param('dir', 'ASC');
$group = optional_param('group',-1,PARAM_INT);
$id = required_param('id', PARAM_INT); // Course Module ID
$action = optional_param('action', '', PARAM_ALPHA);
$sort = optional_param('sort', 'lastname', PARAM_ALPHA);
$dir = optional_param('dir', 'ASC', PARAM_ALPHA);
$group = optional_param('group', -1, PARAM_INT);
$timenow = time();
mod/workshop/viewassessment.php
+4 -4
View File
@@ -4,10 +4,10 @@
require("lib.php");
require("locallib.php");
$aid = required_param('aid',PARAM_INT); // Assessment ID
$allowcomments = optional_param('allowcomments', false);
$redirect = optional_param('redirect', '');
$frameset = optional_param('frameset','',PARAM_ALPHA);
$aid = required_param('aid', PARAM_INT); // Assessment ID
$allowcomments = optional_param('allowcomments', false, PARAM_BOOL);
$redirect = optional_param('redirect', '', PARAM_URL);
$frameset = optional_param('frameset', '', PARAM_ALPHA);
if (! $assessment = get_record("workshop_assessments", "id", $aid)) {
error("Assessment id is incorrect");