L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-50614 mod_scorm: Improve validation on currentorg

Browse Source
This commit is contained in:
Dan Marsden
2015-06-30 10:14:56 +08:00
committed by David Monllao
parent 630b8fdaea
commit f3e7afedb9
3 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod/scorm/loaddatamodel.php
+7
View File
@@ -44,6 +44,13 @@ if (!empty($id)) {
print_error('missingparameter');
}
// PARAM_RAW is used for $currentorg, validate it against records stored in the table.
if (!empty($currentorg)) {
if (!$DB->record_exists('scorm_scoes', array('scorm' => $scorm->id, 'identifier' => $currentorg))) {
$currentorg = '';
}
}
$PAGE->set_url('/mod/scorm/loaddatamodel.php', array('scoid'=>$scoid, 'id'=>$cm->id));
require_login($course, false, $cm);
mod/scorm/player.php
+8
View File
@@ -51,6 +51,14 @@ if (!empty($id)) {
} else {
print_error('missingparameter');
}
// PARAM_RAW is used for $currentorg, validate it against records stored in the table.
if (!empty($currentorg)) {
if (!$DB->record_exists('scorm_scoes', array('scorm' => $scorm->id, 'identifier' => $currentorg))) {
$currentorg = '';
}
}
// If new attempt is being triggered set normal mode and increment attempt number.
$attempt = scorm_get_last_attempt($scorm->id, $USER->id);
mod/scorm/prereqs.php
+7
View File
@@ -50,6 +50,13 @@ if (!empty($id)) {
print_error('missingparameter');
}
// PARAM_RAW is used for $currentorg, validate it against records stored in the table.
if (!empty($currentorg)) {
if (!$DB->record_exists('scorm_scoes', array('scorm' => $scorm->id, 'identifier' => $currentorg))) {
$currentorg = '';
}
}
$PAGE->set_url('/mod/scorm/prereqs.php', array('scoid'=>$scoid, 'attempt'=>$attempt, 'id'=>$cm->id));
require_login($course, false, $cm);