From f1c403dcec42b739323514ddf5a86b8e757253bb Mon Sep 17 00:00:00 2001
From: Matteo Scaramuccia <moodle@matteoscaramuccia.com>
Date: Thu, 15 Nov 2012 12:37:21 +0100
Subject: [PATCH] MDL-36641 Missing HTTP check when using an external resource

---
 mod/scorm/lang/en/scorm.php |  1 +
 mod/scorm/locallib.php      | 24 ++++++++++++++++++++++++
 mod/scorm/mod_form.php      | 23 +++++++++++++++++++++++
 3 files changed, 48 insertions(+)

diff --git a/mod/scorm/lang/en/scorm.php b/mod/scorm/lang/en/scorm.php
index 9409c7a6dff..3e0615e6e68 100644
--- a/mod/scorm/lang/en/scorm.php
+++ b/mod/scorm/lang/en/scorm.php
@@ -180,6 +180,7 @@ $string['interactionsweight'] = 'Weight assigned to the element';
 $string['interactionslearnerresponse'] = 'Learner\'s Response';
 $string['invalidactivity'] = 'Scorm activity is incorrect';
 $string['invalidurl'] = 'Invalid URL specified';
+$string['invalidurlhttpcheck'] = 'Invalid URL specified. Debug message:<pre>{$a->cmsg}</pre>';
 $string['invalidhacpsession'] = 'Invalid HACP Session';
 $string['invalidmanifestresource'] = 'WARNING: The following resources were referenced in your manifest but couldn\'t be found:';
 $string['last'] = 'Last accessed on';
diff --git a/mod/scorm/locallib.php b/mod/scorm/locallib.php
index 57088dcafea..6360aaffebf 100644
--- a/mod/scorm/locallib.php
+++ b/mod/scorm/locallib.php
@@ -1864,3 +1864,27 @@ function scorm_get_adlnav_json ($scoes, &$adlnav = array(), $parentscoid = null)
     }
     return json_encode($adlnav);
 }
+
+/**
+ * Check for the availability of a resource by URL.
+ *
+ * Check is performed using an HTTP HEAD call.
+ *
+ * @param $url string A valid URL
+ * @return bool|string True if no issue is found. The error string message, otherwise
+ */
+function scorm_check_url($url) {
+    $curl = new curl;
+
+    if (!ini_get('open_basedir') and !ini_get('safe_mode')) {
+        // Same options as in {@link download_file_content()}, used in {@link scorm_parse_scorm()}.
+        $curl->setopt(array('CURLOPT_FOLLOWLOCATION' => true, 'CURLOPT_MAXREDIRS' => 5));
+    }
+    $cmsg = $curl->head($url);
+    $info = $curl->get_info();
+    if (empty($info['http_code']) || $info['http_code'] != 200) {
+        return get_string('invalidurlhttpcheck', 'scorm', array('cmsg' => $cmsg));
+    }
+
+    return true;
+}
diff --git a/mod/scorm/mod_form.php b/mod/scorm/mod_form.php
index 0798bc4adb0..b9a79174ec2 100644
--- a/mod/scorm/mod_form.php
+++ b/mod/scorm/mod_form.php
@@ -393,14 +393,28 @@ class mod_scorm_mod_form extends moodleform_mod {
 
         } else if ($type === SCORM_TYPE_EXTERNAL) {
             $reference = $data['packageurl'];
+            // Syntax check.
             if (!preg_match('/(http:\/\/|https:\/\/|www).*\/imsmanifest.xml$/i', $reference)) {
                 $errors['packageurl'] = get_string('invalidurl', 'scorm');
+            } else {
+                // Availability check.
+                $result = scorm_check_url($reference);
+                if (is_string($result)) {
+                    $errors['packageurl'] = $result;
+                }
             }
 
         } else if ($type === 'packageurl') {
             $reference = $data['reference'];
+            // Syntax check.
             if (!preg_match('/(http:\/\/|https:\/\/|www).*(\.zip|\.pif)$/i', $reference)) {
                 $errors['packageurl'] = get_string('invalidurl', 'scorm');
+            } else {
+                // Availability check.
+                $result = scorm_check_url($reference);
+                if (is_string($result)) {
+                    $errors['packageurl'] = $result;
+                }
             }
 
         } else if ($type === SCORM_TYPE_IMSREPOSITORY) {
@@ -408,11 +422,20 @@ class mod_scorm_mod_form extends moodleform_mod {
             if (stripos($reference, '#') !== 0) {
                 $errors['packageurl'] = get_string('invalidurl', 'scorm');
             }
+
         } else if ($type === SCORM_TYPE_AICCURL) {
             $reference = $data['packageurl'];
+            // Syntax check.
             if (!preg_match('/(http:\/\/|https:\/\/|www).*/', $reference)) {
                 $errors['packageurl'] = get_string('invalidurl', 'scorm');
+            } else {
+                // Availability check.
+                $result = scorm_check_url($reference);
+                if (is_string($result)) {
+                    $errors['packageurl'] = $result;
+                }
             }
+
         }
 
         return $errors;