diff --git a/mod/workshop/assess.php b/mod/workshop/assess.php index 2374b60782a..814547973e9 100644 --- a/mod/workshop/assess.php +++ b/mod/workshop/assess.php @@ -4,11 +4,11 @@ require("lib.php"); require("locallib.php"); - $id = required_param('id',PARAM_INT); // Submission ID - $allowcomments = optional_param('allowcomments', false); - $redirect = optional_param('redirect', ''); - $frameset = optional_param('frameset','',PARAM_ALPHA); - $sid = optional_param('sid',0,PARAM_INT); + $id = required_param('id', PARAM_INT); // Submission ID + $allowcomments = optional_param('allowcomments', 0, PARAM_BOOL); + $redirect = optional_param('redirect', '', PARAM_URL); + $frameset = optional_param('frameset', '', PARAM_ALPHA); + $sid = optional_param('sid', 0, PARAM_INT); if (! $submission = get_record('workshop_submissions', 'id', $sid)) { error("Incorrect submission id"); diff --git a/mod/workshop/assessments.php b/mod/workshop/assessments.php index 3cda3ebb5c7..476a9f208b5 100644 --- a/mod/workshop/assessments.php +++ b/mod/workshop/assessments.php @@ -30,15 +30,15 @@ require("lib.php"); require("locallib.php"); - $id = optional_param('id', 0, PARAM_INT); // Course Module ID - $wid = optional_param('wid', 0, PARAM_INT); // Workshop ID - $aid = optional_param('aid',0,PARAM_INT); - $userid = optional_param('userid',0,PARAM_INT); - $cid = optional_param('cid',0,PARAM_INT ); // comment id - $sid = optional_param('sid',0,PARAM_INT); // submission id - $action = required_param( 'action',PARAM_ALPHA ); - $elementno = optional_param( 'elementno',-1,PARAM_INT ); - $stockcommentid = optional_param( 'stockcommentid',0,PARAM_INT ); + $action = required_param('action', PARAM_ALPHA); + $id = optional_param('id', 0, PARAM_INT); // Course Module ID + $wid = optional_param('wid', 0, PARAM_INT); // Workshop ID + $aid = optional_param('aid', 0, PARAM_INT); + $userid = optional_param('userid', 0, PARAM_INT); + $cid = optional_param('cid', 0, PARAM_INT ); // comment id + $sid = optional_param('sid', 0, PARAM_INT); // submission id + $elementno = optional_param('elementno', -1, PARAM_INT); + $stockcommentid = optional_param('stockcommentid', 0, PARAM_INT); // get some useful stuff... if ($id) { @@ -84,7 +84,7 @@ print_heading_with_help(get_string("addacomment", "workshop"), "addingacomment", "workshop"); // get assessment record - if (!$assessmentid = $_REQUEST['aid']) { // comes from link or hidden form variable + if (!$assessmentid = $aid) { // comes from link or hidden form variable error("Assessment id not given"); } $assessment = get_record("workshop_assessments", "id", $assessmentid); @@ -95,7 +95,7 @@
- +
workshopid = $workshop->id; $element->assessmentid = $assessment->id; - $element->elementno = $key; + $element->elementno = clean_param($key, PARAM_INT); $element->feedback = $form->{"feedback_$key"}; $element->grade = $thegrade; if (!$element->id = insert_record("workshop_grades", $element)) { @@ -282,7 +282,7 @@ unset($element); $element->workshopid = $workshop->id; $element->assessmentid = $assessment->id; - $element->elementno = $key; + $element->elementno = clean_param($key, PARAM_INT); $element->feedback = $form->{"feedback_$key"}; $element->grade = $thegrade; if (!$element->id = insert_record("workshop_grades", $element)) { @@ -737,7 +737,7 @@ unset($element); $element->description = $description; $element->workshopid = $workshop->id; - $element->elementno = $key; + $element->elementno = clean_param($key, PARAM_INT); if (isset($form->scale[$key])) { $element->scale = $form->scale[$key]; switch ($WORKSHOP_SCALES[$form->scale[$key]]['type']) { @@ -763,7 +763,7 @@ foreach ($form->maxscore as $key => $themaxscore) { unset($element); $element->workshopid = $workshop->id; - $element->elementno = $key; + $element->elementno = clean_param($key, PARAM_INT); $element->maxscore = $themaxscore; if (isset($form->description[$key])) { $element->description = $form->description[$key]; @@ -782,7 +782,7 @@ foreach ($form->description as $key => $description) { unset($element); $element->workshopid = $workshop->id; - $element->elementno = $key; + $element->elementno = clean_param($key, PARAM_INT); $element->description = $description; $element->weight = $form->weight[$key]; for ($j=0;$j<5;$j++) { @@ -936,7 +936,7 @@ unset($element); $element->workshopid = $workshop->id; $element->assessmentid = $assessment->id; - $element->elementno = $key; + $element->elementno = clean_param($key, PARAM_INT); $element->feedback = $form->{"feedback_$key"}; $element->grade = $thegrade; if (!$element->id = insert_record("workshop_grades", $element)) { @@ -1023,7 +1023,7 @@ unset($element); $element->workshopid = $workshop->id; $element->assessmentid = $assessment->id; - $element->elementno = $key; + $element->elementno = clean_param($key, PARAM_INT); $element->feedback = $form->{"feedback_$key"}; $element->grade = $thegrade; if (!$element->id = insert_record("workshop_grades", $element)) { @@ -1200,7 +1200,7 @@ unset($element); $element->workshopid = $workshop->id; $element->assessmentid = $assessment->id; - $element->elementno = $key; + $element->elementno = clean_param($key, PARAM_INT); $element->feedback = $form->{"feedback_$key"}; $element->grade = $thegrade; if (!$element->id = insert_record("workshop_grades", $element)) { diff --git a/mod/workshop/submissions.php b/mod/workshop/submissions.php index 14679ffb4dc..a2d32a0e1ee 100644 --- a/mod/workshop/submissions.php +++ b/mod/workshop/submissions.php @@ -21,14 +21,14 @@ require("lib.php"); require("locallib.php"); - $id = required_param('id',PARAM_INT); // Course Module ID - $action = optional_param('action','',PARAM_ALPHA); - $sid = optional_param('sid',0,PARAM_INT); //submission id - $order = optional_param('order','name',PARAM_ALPHA); - $title = optional_param('title','',PARAM_CLEAN); - $nentries = optional_param('nentries','',PARAM_ALPHANUM); - $anonymous = optional_param('anonymous','',PARAM_CLEAN); - $description = optional_param('description','',PARAM_CLEAN); + $id = required_param('id', PARAM_INT); // Course Module ID + $action = optional_param('action', '', PARAM_ALPHA); + $sid = optional_param('sid', 0, PARAM_INT); //submission id + $order = optional_param('order', 'name', PARAM_ALPHA); + $title = optional_param('title', '', PARAM_CLEAN); + $nentries = optional_param('nentries', '', PARAM_ALPHANUM); + $anonymous = optional_param('anonymous', '', PARAM_CLEAN); + $description = optional_param('description', '', PARAM_CLEAN); $timenow = time(); diff --git a/mod/workshop/upload.php b/mod/workshop/upload.php index 18a2c12f9e6..a66e5b37471 100644 --- a/mod/workshop/upload.php +++ b/mod/workshop/upload.php @@ -4,7 +4,7 @@ require("lib.php"); require("locallib.php"); - $id = required_param('id',PARAM_INT); // CM ID + $id = required_param('id', PARAM_INT); // CM ID if (! $cm = get_record("course_modules", "id", $id)) { @@ -55,11 +55,11 @@ // get the current set of submissions $submissions = workshop_get_user_submissions($workshop, $USER); // add new submission record - $newsubmission->workshopid = $workshop->id; - $newsubmission->userid = $USER->id; - $newsubmission->title = $title; - $newsubmission->description = trim($form->description); - $newsubmission->timecreated = $timenow; + $newsubmission->workshopid = $workshop->id; + $newsubmission->userid = $USER->id; + $newsubmission->title = clean_param($title, PARAM_CLEAN); + $newsubmission->description = trim(clean_param($form->description, PARAM_CLEAN)); + $newsubmission->timecreated = $timenow; if ($timenow > $workshop->submissionend) { $newsubmission->late = 1; } diff --git a/mod/workshop/view.php b/mod/workshop/view.php index ded41c5e1f8..9ec708cbc9e 100644 --- a/mod/workshop/view.php +++ b/mod/workshop/view.php @@ -17,11 +17,11 @@ require("lib.php"); require("locallib.php"); - $id = required_param('id',PARAM_INT); // Course Module ID - $action = optional_param('action', '',PARAM_ALPHA); - $sort = optional_param('sort', 'lastname'); - $dir = optional_param('dir', 'ASC'); - $group = optional_param('group',-1,PARAM_INT); + $id = required_param('id', PARAM_INT); // Course Module ID + $action = optional_param('action', '', PARAM_ALPHA); + $sort = optional_param('sort', 'lastname', PARAM_ALPHA); + $dir = optional_param('dir', 'ASC', PARAM_ALPHA); + $group = optional_param('group', -1, PARAM_INT); $timenow = time(); diff --git a/mod/workshop/viewassessment.php b/mod/workshop/viewassessment.php index 7113aacfaaa..ac058d76f38 100644 --- a/mod/workshop/viewassessment.php +++ b/mod/workshop/viewassessment.php @@ -4,10 +4,10 @@ require("lib.php"); require("locallib.php"); - $aid = required_param('aid',PARAM_INT); // Assessment ID - $allowcomments = optional_param('allowcomments', false); - $redirect = optional_param('redirect', ''); - $frameset = optional_param('frameset','',PARAM_ALPHA); + $aid = required_param('aid', PARAM_INT); // Assessment ID + $allowcomments = optional_param('allowcomments', false, PARAM_BOOL); + $redirect = optional_param('redirect', '', PARAM_URL); + $frameset = optional_param('frameset', '', PARAM_ALPHA); if (! $assessment = get_record("workshop_assessments", "id", $aid)) { error("Assessment id is incorrect");