From f0db65600276ca489bdad731f17b3d4bd14e06c7 Mon Sep 17 00:00:00 2001
From: Paul Holden <paulh@moodle.com>
Date: Mon, 22 Feb 2021 20:02:40 +0000
Subject: [PATCH] MDL-70979 search: validate external user search parameters.

Clean return value in unit test for same.
---
 search/classes/external.php    |  9 +++++++--
 search/tests/external_test.php | 22 ++++++++++++++--------
 2 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/search/classes/external.php b/search/classes/external.php
index ce29bb2f032..947d336a6fc 100644
--- a/search/classes/external.php
+++ b/search/classes/external.php
@@ -81,8 +81,13 @@ class external extends \external_api {
         global $CFG, $PAGE;
 
         // Validate parameter.
-        self::validate_parameters(self::get_relevant_users_parameters(),
-                ['query' => $query, 'courseid' => $courseid]);
+        [
+            'query' => $query,
+            'courseid' => $courseid,
+        ] = self::validate_parameters(self::get_relevant_users_parameters(), [
+            'query' => $query,
+            'courseid' => $courseid,
+        ]);
 
         // Validate the context (search page is always system context).
         $systemcontext = \context_system::instance();
diff --git a/search/tests/external_test.php b/search/tests/external_test.php
index a78a2c2d4f2..047a9a965ae 100644
--- a/search/tests/external_test.php
+++ b/search/tests/external_test.php
@@ -24,8 +24,6 @@
 
 namespace core_search;
 
-defined('MOODLE_INTERNAL') || die();
-
 /**
  * External function unit tests.
  *
@@ -55,16 +53,24 @@ class external_testcase extends \advanced_testcase {
 
         // As student 3, search for the other two.
         $this->setUser($student3);
-        $result = external::get_relevant_users('Amelia', 0);
-        $this->assertCount(2, $result);
+        $result = external::clean_returnvalue(
+            external::get_relevant_users_returns(),
+            external::get_relevant_users('Amelia', 0)
+        );
+
+        // Check we got the two expected users back.
+        $this->assertEquals([
+            $student1->id,
+            $student2->id,
+        ], array_column($result, 'id'));
 
         // Check that the result contains all the expected fields.
-        $this->assertEquals($student1->id, $result[0]->id);
-        $this->assertEquals('Amelia Aardvark', $result[0]->fullname);
-        $this->assertStringContainsString('/u/f2', $result[0]->profileimageurlsmall);
+        $this->assertEquals($student1->id, $result[0]['id']);
+        $this->assertEquals('Amelia Aardvark', $result[0]['fullname']);
+        $this->assertStringContainsString('/u/f2', $result[0]['profileimageurlsmall']);
 
         // Check we aren't leaking information about user email address (for instance).
-        $this->assertObjectNotHasAttribute('email', $result[0]);
+        $this->assertArrayNotHasKey('email', $result[0]);
 
         // Note: We are not checking search permissions, search by different fields, etc. as these
         // are covered by the core_user::search unit test.