L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-31762 username should be lowercase and check against PARAM_USERNAME when creating/updating user by web service

Browse Source
This commit is contained in:
Jerome Mouneyrac
2012-05-02 17:52:35 +12:00
committed by Sam Hemelryk
parent cc2a87e3fe
commit e0a57f8ccc
2 changed files with 23 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
user/externallib.php
+3 -3
View File
@@ -43,7 +43,7 @@ class core_user_external extends external_api {
'users' => new external_multiple_structure(
new external_single_structure(
array(
'username' => new external_value(PARAM_RAW, 'Username policy is defined in Moodle security config'),
'username' => new external_value(PARAM_USERNAME, 'Username policy is defined in Moodle security config. Must be lowercase.'),
'password' => new external_value(PARAM_RAW, 'Plain text password consisting of any characters'),
'firstname' => new external_value(PARAM_NOTAGS, 'The first name(s) of the user'),
'lastname' => new external_value(PARAM_NOTAGS, 'The family name of the user'),
@@ -184,7 +184,7 @@ class core_user_external extends external_api {
new external_single_structure(
array(
'id' => new external_value(PARAM_INT, 'user id'),
'username' => new external_value(PARAM_RAW, 'user name'),
'username' => new external_value(PARAM_USERNAME, 'user name'),
)
)
);
@@ -259,7 +259,7 @@ class core_user_external extends external_api {
new external_single_structure(
array(
'id' => new external_value(PARAM_NUMBER, 'ID of the user'),
'username' => new external_value(PARAM_RAW, 'Username policy is defined in Moodle security config', VALUE_OPTIONAL, '',NULL_NOT_ALLOWED),
'username' => new external_value(PARAM_USERNAME, 'Username policy is defined in Moodle security config. Must be lowercase.', VALUE_OPTIONAL, '',NULL_NOT_ALLOWED),
'password' => new external_value(PARAM_RAW, 'Plain text password consisting of any characters', VALUE_OPTIONAL, '',NULL_NOT_ALLOWED),
'firstname' => new external_value(PARAM_NOTAGS, 'The first name(s) of the user', VALUE_OPTIONAL, '',NULL_NOT_ALLOWED),
'lastname' => new external_value(PARAM_NOTAGS, 'The family name of the user', VALUE_OPTIONAL),
user/lib.php
+20
View File
@@ -39,6 +39,15 @@ function user_create_user($user) {
$user = (object)$user;
}
//check username
if ($user->username !== textlib::strtolower($user->username)) {
throw new moodle_exception('usernamelowercase');
} else {
if ($user->username !== clean_param($user->username, PARAM_USERNAME)) {
throw new moodle_exception('invalidusername');
}
}
// save the password in a temp value for later
if (isset($user->password)) {
$userpassword = $user->password;
@@ -80,6 +89,17 @@ function user_update_user($user) {
$user = (object)$user;
}
//check username
if (isset($user->username)) {
if ($user->username !== textlib::strtolower($user->username)) {
throw new moodle_exception('usernamelowercase');
} else {
if ($user->username !== clean_param($user->username, PARAM_USERNAME)) {
throw new moodle_exception('invalidusername');
}
}
}
// unset password here, for updating later
if (isset($user->password)) {
$passwd = $user->password;