From f59e91bcf8807582ca14c7f24842fda97a272ce4 Mon Sep 17 00:00:00 2001
From: thepurpleblob <thepurpleblob>
Date: Wed, 6 Jul 2005 15:31:07 +0000
Subject: [PATCH] _variable() functions, _GET, _POST etc. changed to
 appropriate _param() style functions.

---
 mod/workshop/assess.php         | 12 +++--
 mod/workshop/assessments.php    | 64 ++++++++++++++-----------
 mod/workshop/index.php          |  2 +-
 mod/workshop/submissions.php    | 85 ++++++++++++++++-----------------
 mod/workshop/upload.php         |  2 +-
 mod/workshop/view.php           | 12 +++--
 mod/workshop/viewassessment.php | 11 +++--
 7 files changed, 98 insertions(+), 90 deletions(-)

diff --git a/mod/workshop/assess.php b/mod/workshop/assess.php
index cfe4471e2ee..584407a8f26 100644
--- a/mod/workshop/assess.php
+++ b/mod/workshop/assess.php
@@ -4,9 +4,11 @@
     require("lib.php");
     require("locallib.php");
 
-    require_variable($sid);   // Submission ID
-    optional_variable($allowcomments, false);
-    optional_variable($redirect, '');
+    $id = required_param('id',PARAM_INT);   // Submission ID
+    $allowcomments = optional_param('allowcomments', false);
+    $redirect = optional_param('redirect', '');
+    $frameset = optional_param('frameset','',PARAM_ALPHA);
+    $sid = optional_param('sid',0,PARAM_INT);
 
     if (! $submission = get_record('workshop_submissions', 'id', $sid)) {
         error("Incorrect submission id");
@@ -33,7 +35,7 @@
 
     /// Now check whether we need to display a frameset
 
-    if (empty($_GET['frameset'])) {
+    if (empty($frameset)) {
         echo "<head><title>{$course->shortname}: ".format_string($workshop->name,true)."</title></head>\n";
         echo "<frameset rows=\"50%,*\" border=\"10\">";
         echo "<frame src=\"assess.php?id=$id&amp;sid=$sid&amp;frameset=top&amp;redirect=$redirect\" border=\"10\">";
@@ -44,7 +46,7 @@
 
     /// top frame with the navigation bar and the assessment form
 
-    if (!empty($_GET['frameset']) and $_GET['frameset'] == "top") {
+    if ($frameset == "top") {
 
         print_header_simple(format_string($workshop->name), "",
                      "<a href=\"index.php?id=$course->id\">$strworkshops</a> ->
diff --git a/mod/workshop/assessments.php b/mod/workshop/assessments.php
index 4f71767695d..77bb780f392 100644
--- a/mod/workshop/assessments.php
+++ b/mod/workshop/assessments.php
@@ -30,8 +30,15 @@
     require("lib.php");
     require("locallib.php");
 
-    optional_variable($id, '');    // Course Module ID
-    optional_variable($wid, '');    // Workshop ID
+    $id = optional_param('id', 0, PARAM_INT);    // Course Module ID
+    $wid = optional_param('wid', 0, PARAM_INT);    // Workshop ID
+    $aid = optional_param('aid',0,PARAM_INT); 
+    $userid = optional_param('userid',0,PARAM_INT);
+    $cid = optional_param('cid',0,PARAM_INT ); // comment id
+    $sid = optional_param('sid',0,PARAM_INT); // submission id
+    $action = required_param( 'action',PARAM_ALPHA );
+    $elementno = optional_param( 'elementno',-1,PARAM_INT );
+    $stockcommentid = optional_param( 'stockcommentid',0,PARAM_INT );
 
     // get some useful stuff...
     if ($id) {
@@ -72,10 +79,6 @@
                   <a href=\"view.php?id=$cm->id\">".format_string($workshop->name,true)."</a> -> $strassessments",
                   "", "", true);
 
-    //...get the action
-    require_variable($action);
-
-
     /*************** add comment to assessment (by author, assessor or teacher) ***************************/
     if ($action == 'addcomment') {
 
@@ -118,8 +121,9 @@
     /*************** add stock comment (by teacher ) ***************************/
     elseif ($action == 'addstockcomment') {
 
-        require_variable($aid);
-        require_variable($elementno);
+        if (empty($aid) or ($elementno<0)) {
+            error("Workshop Assessment ID and/or Element Number missing");
+        }
 
         if (!isteacher($course->id)) {
             error("Only teachers can look at this page");
@@ -318,28 +322,28 @@
     /******************* confirm delete ************************************/
     elseif ($action == 'confirmdelete' ) {
 
-        if (empty($_GET['aid'])) {
+        if (empty($aid)) {
             error("Confirm delete: assessment id missing");
             }
 
         notice_yesno(get_string("confirmdeletionofthisitem","workshop", get_string("assessment", "workshop")),
-             "assessments.php?action=delete&amp;id=$cm->id&amp;aid=$_GET[aid]", "submissions.php?action=adminlist&amp;id=$cm->id");
+             "assessments.php?action=delete&amp;id=$cm->id&amp;aid=$aid", "submissions.php?action=adminlist&amp;id=$cm->id");
         }
 
 
     /******************* delete ************************************/
     elseif ($action == 'delete' ) {
 
-        if (empty($_GET['aid'])) {
+        if (empty($aid)) {
             error("Delete: submission id missing");
             }
 
         print_string("deleting", "workshop");
         // first delete all the associated records...
-        delete_records("workshop_comments", "assessmentid", $_GET['aid']);
-        delete_records("workshop_grades", "assessmentid", $_GET['aid']);
+        delete_records("workshop_comments", "assessmentid", $aid);
+        delete_records("workshop_grades", "assessmentid", $aid);
         // ...now delete the assessment...
-        delete_records("workshop_assessments", "id", $_GET['aid']);
+        delete_records("workshop_assessments", "id", $aid);
 
         print_continue("view.php?id=$cm->id");
         }
@@ -352,10 +356,10 @@
             error("Only teachers can look at this page");
             }
 
-        if (empty($_GET['sid'])) {
+        if (empty($sid)) {
             error ("Workshop asssessments: adminlist called with no sid");
             }
-        $submission = get_record("workshop_submissions", "id", $_GET['sid']);
+        $submission = get_record("workshop_submissions", "id", $sid);
         workshop_print_assessments_for_admin($workshop, $submission);
         print_continue("submissions.php?action=adminlist&amp;id=$cm->id");
         }
@@ -368,10 +372,10 @@
             error("Only teachers can look at this page");
             }
 
-        if (empty($_GET['userid'])) {
+        if (empty($userid)) {
             error ("Workshop asssessments: adminlistbystudent called with no userid");
             }
-        $user = get_record("user", "id", $_GET['userid']);
+        $user = get_record("user", "id", $userid);
         workshop_print_assessments_by_user_for_admin($workshop, $user);
         print_continue("submissions.php?action=adminlist&amp;id=$cm->id");
         }
@@ -381,7 +385,7 @@
     elseif ($action == 'agreeassessment') {
         $timenow = time();
         // assessment id comes from link or hidden form variable
-        if (!$assessment = get_record("workshop_assessments", "id", $_REQUEST['aid'])) {
+        if (!$assessment = get_record("workshop_assessments", "id", $aid)) {
             error("Assessment : agree assessment failed");
             }
         //save time of agreement
@@ -409,7 +413,7 @@
 
         print_heading_with_help(get_string("editacomment", "workshop"), "editingacomment", "workshop");
         // get the comment record...
-        if (!$comment = get_record("workshop_comments", "id", $_GET['cid'])) {
+        if (!$comment = get_record("workshop_comments", "id", $cid)) {
             error("Edit Comment: Comment not found");
             }
         if (!$assessment = get_record("workshop_assessments", "id", $comment->assessmentid)) {
@@ -422,7 +426,7 @@
         <form name="gradingform" action="assessments.php" method="post">
         <input type="hidden" name="action" value="updatecomment" />
         <input type="hidden" name="id" value="<?php echo $cm->id ?>" />
-        <input type="hidden" name="cid" value="<?php echo $_GET['cid'] ?>" />
+        <input type="hidden" name="cid" value="<?php echo $cid ?>" />
         <center>
         <table cellpadding="5" border="1">
         <?php
@@ -650,7 +654,7 @@
 
         print_heading_with_help(get_string("gradeassessment", "workshop"), "gradingassessments", "workshop");
         // get assessment record
-        if (!$assessmentid = $_GET['aid']) {
+        if (!$assessmentid = $aid) {
             error("Assessment id not given");
         }
         $assessment = get_record("workshop_assessments", "id", $assessmentid);
@@ -678,7 +682,7 @@
 
         $form = (object)$_POST;
 
-        if (!$assessment = get_record("workshop_assessments", "id", $_POST['aid'])) {
+        if (!$assessment = get_record("workshop_assessments", "id", $aid)) {
             error("Unable to insert comment");
             }
         // save the comment...
@@ -686,7 +690,7 @@
         $comment->assessmentid   = $assessment->id;
         $comment->userid   = $USER->id;
         $comment->timecreated   = $timenow;
-        $comment->comments   = $form->comments;
+        $comment->comments   = clean_param($form->comments, PARAM_CLEAN);
         if (!$comment->id = insert_record("workshop_comments", $comment)) {
             error("Could not insert workshop comment!");
             }
@@ -871,8 +875,9 @@
     /*************** remove stock comment (by teacher ) ***************************/
     elseif ($action == 'removestockcomment') {
 
-        require_variable($aid);
-        require_variable($stockcommentid);
+        if (empty($aid) or empty($stockcommentid)) {
+            error("Workshop Assessment id and/or Stock Comment id missing");
+        }
 
         if (!isteacher($course->id)) {
             error("Only teachers can look at this page");
@@ -1058,7 +1063,10 @@
     /*************** update assessment (by teacher or student) ***************************/
     elseif ($action == 'updateassessment') {
 
-        require_variable($aid);
+        if (empty($aid)) {
+            error("Workshop Assessment id missing");
+        }
+
         if (! $assessment = get_record("workshop_assessments", "id", $aid)) {
             error("workshop assessment is misconfigured");
         }
@@ -1355,7 +1363,7 @@
     /****************** view all assessments ***********************/
     elseif ($action == 'viewallassessments') {
 
-        if (!$submission = get_record("workshop_submissions", "id", $_GET['sid'])) {
+        if (!$submission = get_record("workshop_submissions", "id", $sid)) {
             error("View All Assessments: submission record not found");
         }
 
diff --git a/mod/workshop/index.php b/mod/workshop/index.php
index 92b5a619442..82f72dbd897 100644
--- a/mod/workshop/index.php
+++ b/mod/workshop/index.php
@@ -4,7 +4,7 @@
     require("lib.php");
     require("locallib.php");
 
-    require_variable($id);   // course
+    $id = required_param('id',PARAM_INT);   // course
 
     if (! $course = get_record("course", "id", $id)) {
         error("Course ID is incorrect");
diff --git a/mod/workshop/submissions.php b/mod/workshop/submissions.php
index ac741cc1299..34e5b5c4427 100644
--- a/mod/workshop/submissions.php
+++ b/mod/workshop/submissions.php
@@ -21,7 +21,14 @@
     require("lib.php");
     require("locallib.php");
 
-    require_variable($id);    // Course Module ID
+    $id = required_param('id',PARAM_INT);    // Course Module ID
+    $action = optional_param('action','',PARAM_ALPHA);
+    $sid = optional_param('sid',0,PARAM_INT); //submission id
+    $order = optional_param('order','name',PARAM_ALPHA);
+    $title = optional_param('title','',PARAM_CLEAN);
+    $nentries = optional_param('nentries','',PARAM_ALPHANUM);
+    $anonymous = optional_param('anonymous','',PARAM_CLEAN);
+    $description = optional_param('description','',PARAM_CLEAN);
 
     $timenow = time();
 
@@ -49,7 +56,6 @@
                   "", "", true);
 
     //...get the action or set up an suitable default
-    optional_variable($action);
     if (empty($action)) {
         $action = "listallsubmissions";
     }
@@ -61,17 +67,17 @@
         if (!isteacher($course->id)) {
             error("Only teachers can look at this page");
         }
-        if (empty($_GET['sid'])) {
+        if (empty($sid)) {
             error("Admin Amend Title: submission id missing");
         }
 
-        $submission = get_record("workshop_submissions", "id", $_GET['sid']);
+        $submission = get_record("workshop_submissions", "id", $sid);
         print_heading(get_string("amendtitle", "workshop"));
         ?>
         <form name="amendtitleform" action="submissions.php" method="post">
         <input type="hidden" name="action" value="adminupdatetitle" />
         <input type="hidden" name="id" value="<?php echo $cm->id ?>" />
-        <input type="hidden" name="sid" value="<?php echo $_REQUEST['sid'] ?>" />
+        <input type="hidden" name="sid" value="<?php echo $sid ?>" />
         <center>
         <table cellpadding="5" border="1">
         <?php
@@ -95,14 +101,14 @@
         if (!isteacher($course->id)) {
             error("Only teachers can look at this page");
         }
-        if (empty($_GET['sid'])) {
+        if (empty($sid)) {
             error("Admin clear late flag: submission id missing");
         }
 
-        if (!$submission = get_record("workshop_submissions", "id", $_GET['sid'])) {
+        if (!$submission = get_record("workshop_submissions", "id", $sid)) {
             error("Admin clear late flag: can not get submission record");
         }
-        if (set_field("workshop_submissions", "late", 0, "id", $_GET['sid'])) {
+        if (set_field("workshop_submissions", "late", 0, "id", $sid)) {
             print_heading(get_string("clearlateflag", "workshop")." ".get_string("ok"));
         }
 
@@ -115,10 +121,9 @@
     /******************* confirm delete ************************************/
     elseif ($action == 'confirmdelete' ) {
 
-        if (empty($_GET['sid'])) {
+        if (empty($sid)) {
             error("Confirm delete: submission id missing");
             }
-        $sid = $_GET['sid'];
         notice_yesno(get_string("confirmdeletionofthisitem","workshop", get_string("submission", "workshop")),
              "submissions.php?action=delete&amp;id=$cm->id&amp;sid=$sid", "view.php?id=$cm->id#sid=$sid");
         }
@@ -127,11 +132,11 @@
     /******************* delete ************************************/
     elseif ($action == 'delete' ) {
 
-        if (empty($_GET['sid'])) {
+        if (empty($sid)) {
             error("Delete: submission id missing");
         }
 
-        if (!$submission = get_record("workshop_submissions", "id", $_GET['sid'])) {
+        if (!$submission = get_record("workshop_submissions", "id", $sid)) {
             error("Admin delete: can not get submission record");
         }
 
@@ -169,15 +174,15 @@
         if (!isteacher($course->id)) {
             error("Only teachers can look at this page");
         }
-        if (empty($_GET['sid'])) {
+        if (empty($sid)) {
             error("Admin confirm late flag: submission id missing");
         }
-        if (!$submission = get_record("workshop_submissions", "id", $_GET['sid'])) {
+        if (!$submission = get_record("workshop_submissions", "id", $sid)) {
             error("Admin confirm late flag: can not get submission record");
         }
 
         notice_yesno(get_string("clearlateflag","workshop")."?",
-             "submissions.php?action=adminclearlate&amp;id=$cm->id&amp;sid=$_GET[sid]",
+             "submissions.php?action=adminclearlate&amp;id=$cm->id&amp;sid=$sid",
              "view.php?id=$cm->id");
     }
 
@@ -188,12 +193,6 @@
         if (!isteacher($course->id)) {
             error("Only teachers can look at this page");
         }
-        if (empty($_GET['order'])) {
-            $order = "name";
-        }
-        else {
-            $order = $_GET['order'];
-        }
 
         workshop_list_submissions_for_admin($workshop, $order);
         print_continue("view.php?id=$cm->id");
@@ -207,11 +206,11 @@
         if (!isteacher($course->id)) {
             error("Only teachers can look at this page");
         }
-        if (empty($_POST['sid'])) {
+        if (empty($sid)) {
             error("Admin Update Title: submission id missing");
         }
 
-        if (set_field("workshop_submissions", "title", $_POST['title'], "id", $_POST['sid'])) {
+        if (set_field("workshop_submissions", "title", $title, "id", $sid)) {
             print_heading(get_string("amendtitle", "workshop")." ".get_string("ok"));
         }
         print_continue("view.php?id=$cm->id");
@@ -221,15 +220,15 @@
     /******************* confirm remove attachments ************************************/
     elseif ($action == 'confirmremoveattachments' ) {
 
-        if (empty($_GET['sid'])) {
+        if (empty($sid)) {
             error("Admin confirm delete: submission id missing");
         }
-        if (!$submission = get_record("workshop_submissions", "id", $_GET['sid'])) {
+        if (!$submission = get_record("workshop_submissions", "id", $sid)) {
             error("Admin delete: can not get submission record");
         }
 
         notice_yesno(get_string("confirmremoveattachments","workshop"),
-             "submissions.php?action=removeattachments&amp;id=$cm->id&amp;sid=$_GET[sid]",
+             "submissions.php?action=removeattachments&amp;id=$cm->id&amp;sid=$sid",
              "view.php?id=$cm->id");
     }
 
@@ -237,12 +236,12 @@
     /******************* edit submission ************************************/
     elseif ($action == 'editsubmission' ) {
 
-        if (empty($_GET['sid'])) {
+        if (empty($sid)) {
             error("Edit submission: submission id missing");
         }
         $usehtmleditor = can_use_html_editor();
 
-        $submission = get_record("workshop_submissions", "id", $_GET['sid']);
+        $submission = get_record("workshop_submissions", "id", $sid);
         print_heading(get_string("editsubmission", "workshop"));
         if ($submission->userid <> $USER->id) {
             error("Edit submission: Userids do not match");
@@ -254,7 +253,7 @@
         <form name="editform" enctype="multipart/form-data" action="submissions.php" method="post">
         <input type="hidden" name="action" value="updatesubmission" />
         <input type="hidden" name="id" value="<?php echo $cm->id ?>" />
-        <input type="hidden" name="sid" value="<?php echo $_GET['sid'] ?>" />
+        <input type="hidden" name="sid" value="<?php echo $sid ?>" />
         <center>
         <table cellpadding="5" border="1">
         <?php
@@ -382,11 +381,11 @@
     /******************* show submission ************************************/
     elseif ($action == 'showsubmission' ) {
 
-        if (empty($_GET['sid'])) {
+        if (empty($sid)) {
             error("Show submission: submission id missing");
         }
 
-        $submission = get_record("workshop_submissions", "id", $_GET['sid']);
+        $submission = get_record("workshop_submissions", "id", $sid);
         $title = '"'.$submission->title.'" ';
         if (isteacher($course->id)) {
             $title .= get_string('by', 'workshop').' '.workshop_fullname($submission->userid, $course->id);
@@ -405,17 +404,15 @@
             error("Only teachers can look at this page");
         }
 
-        $form = (object)$_POST;
-
         // save number of entries in showleaguetable option
-        if ($form->nentries == 'All') {
-            $form->nentries = 99;
+        if ($nentries == 'All') {
+            $nentries = 99;
         }
-        set_field("workshop", "showleaguetable", $form->nentries, "id", "$workshop->id");
+        set_field("workshop", "showleaguetable", $nentries, "id", "$workshop->id");
 
         // save the anonymous option
-        set_field("workshop", "anonymous", $form->anonymous, "id", "$workshop->id");
-        add_to_log($course->id, "workshop", "league table", "view.php?id=$cm->id", $form->nentries, $cm->id);
+        set_field("workshop", "anonymous", $anonymous, "id", "$workshop->id");
+        add_to_log($course->id, "workshop", "league table", "view.php?id=$cm->id", $nentries, $cm->id);
 
         redirect("view.php?id=$cm->id");
     }
@@ -424,12 +421,10 @@
     /*************** update submission ***************************/
     elseif ($action == 'updatesubmission') {
 
-        $form = data_submitted();
-
-        if (empty($form->sid)) {
+        if (empty($sid)) {
             error("Update submission: submission id missing");
         }
-        $submission = get_record("workshop_submissions", "id", $form->sid);
+        $submission = get_record("workshop_submissions", "id", $sid);
 
         // students are only allowed to update their own submission and only up to the deadline
         if (!(isteacher($course->id) or
@@ -439,11 +434,11 @@
         }
 
         // check existence of title
-        if (empty($form->title)) {
+        if (empty($title)) {
             $title = get_string("notitle", "workshop");
         }
-        set_field("workshop_submissions", "title", $form->title, "id", $submission->id);
-        set_field("workshop_submissions", "description", trim($form->description), "id", $submission->id);
+        set_field("workshop_submissions", "title", $title, "id", $submission->id);
+        set_field("workshop_submissions", "description", trim($description), "id", $submission->id);
         set_field("workshop_submissions", "timecreated", $timenow, "id", $submission->id);
         if ($workshop->nattachments) {
             require_once($CFG->dirroot.'/lib/uploadlib.php');
diff --git a/mod/workshop/upload.php b/mod/workshop/upload.php
index af265406308..584f5837dac 100644
--- a/mod/workshop/upload.php
+++ b/mod/workshop/upload.php
@@ -4,7 +4,7 @@
     require("lib.php");
     require("locallib.php");
 
-    require_variable($id);          // CM ID
+    $id = required_param('id',PARAM_INT);          // CM ID
 
 
     if (! $cm = get_record("course_modules", "id", $id)) {
diff --git a/mod/workshop/view.php b/mod/workshop/view.php
index 4aefadc41ef..c4dd9db5076 100644
--- a/mod/workshop/view.php
+++ b/mod/workshop/view.php
@@ -17,10 +17,11 @@
     require("lib.php");
     require("locallib.php");
 
-    require_variable($id);    // Course Module ID
-    optional_variable($action, '');
-    optional_variable($sort, "lastname");
-    optional_variable($dir, "ASC");
+    $id = required_param('id',PARAM_INT);    // Course Module ID
+    $action = optional_param('action', '',PARAM_ALPHA);
+    $sort = optional_param('sort', 'lastname');
+    $dir = optional_param('dir', 'ASC');
+    $group = optional_param('group',-1,PARAM_INT);
 
     $timenow = time();
 
@@ -303,7 +304,8 @@
 
         /// Check to see if groups are being used in this workshop
         /// and if so, set $currentgroup to reflect the current group
-        $changegroup = isset($_GET['group']) ? $_GET['group'] : -1;  // Group change requested?
+        // $changegroup = isset($_GET['_param('group',0,PARAM_INT);group']) ? $_GET['group'] : -1;  // Group change requested?
+        $changegroup = $group;
         $groupmode = groupmode($course, $cm);   // Groups are being used?
         $currentgroup = get_and_set_current_group($course, $groupmode, $changegroup);
 
diff --git a/mod/workshop/viewassessment.php b/mod/workshop/viewassessment.php
index 5debc6855a0..6e41ba7df33 100644
--- a/mod/workshop/viewassessment.php
+++ b/mod/workshop/viewassessment.php
@@ -4,9 +4,10 @@
     require("lib.php");
     require("locallib.php");
 
-    require_variable($aid);   // Assessment ID
-    optional_variable($allowcomments, false);
-    optional_variable($redirect, '');
+    $aid = required_param('aid',PARAM_INT);   // Assessment ID
+    $allowcomments = optional_param('allowcomments', false);
+    $redirect = optional_param('redirect', '');
+    $frameset = optional_param('frameset','',PARAM_ALPHA);
 
     if (! $assessment = get_record("workshop_assessments", "id", $aid)) {
         error("Assessment id is incorrect");
@@ -36,7 +37,7 @@
 
     /// Now check whether we need to display a frameset
 
-    if (empty($_GET['frameset'])) {
+    if (empty($frameset)) {
         echo "<head><title>{$course->shortname}: ".format_string($workshop->name,true)."</title></head>\n";
         echo "<frameset rows=\"90%,*\" border=\"10\">";
         echo "<frame src=\"viewassessment.php?id=$id&amp;aid=$aid&amp;allowcomments=$allowcomments&amp;frameset=top&amp;redirect=$redirect\" border=\"10\">";
@@ -47,7 +48,7 @@
 
     /// top frame with the navigation bar and the assessment form
 
-    if (!empty($_GET['frameset']) and $_GET['frameset'] == "top") {
+    if ($frameset == "top") {
 
         print_header_simple(format_string($workshop->name), "",
                      "<a href=\"index.php?id=$course->id\">$strworkshops</a> ->