MDL-43468 mod_assign: Webservice parameters were not safely cleaned
This commit is contained in:
Frederic Massart
committed by
Dan Poltawski
Dan Poltawski
parent
5d4abb97b2
commit
f96b8a1c67
+46
-37
@@ -1209,16 +1209,17 @@ class mod_assign_external extends external_api {
|
||||
array('assignmentid' => $assignmentid,
|
||||
'userids' => $userids));
|
||||
|
||||
$cm = get_coursemodule_from_instance('assign', $assignmentid, 0, false, MUST_EXIST);
|
||||
$cm = get_coursemodule_from_instance('assign', $params['assignmentid'], 0, false, MUST_EXIST);
|
||||
$context = context_module::instance($cm->id);
|
||||
self::validate_context($context);
|
||||
|
||||
$assignment = new assign($context, $cm, null);
|
||||
|
||||
$warnings = array();
|
||||
foreach ($userids as $userid) {
|
||||
foreach ($params['userids'] as $userid) {
|
||||
if (!$assignment->lock_submission($userid)) {
|
||||
$detail = 'User id: ' . $userid . ', Assignment id: ' . $assignmentid;
|
||||
$warnings[] = self::generate_warning($assignmentid,
|
||||
$detail = 'User id: ' . $userid . ', Assignment id: ' . $params['assignmentid'];
|
||||
$warnings[] = self::generate_warning($params['assignmentid'],
|
||||
'couldnotlock',
|
||||
$detail);
|
||||
}
|
||||
@@ -1272,16 +1273,17 @@ class mod_assign_external extends external_api {
|
||||
array('assignmentid' => $assignmentid,
|
||||
'userids' => $userids));
|
||||
|
||||
$cm = get_coursemodule_from_instance('assign', $assignmentid, 0, false, MUST_EXIST);
|
||||
$cm = get_coursemodule_from_instance('assign', $params['assignmentid'], 0, false, MUST_EXIST);
|
||||
$context = context_module::instance($cm->id);
|
||||
self::validate_context($context);
|
||||
|
||||
$assignment = new assign($context, $cm, null);
|
||||
|
||||
$warnings = array();
|
||||
foreach ($userids as $userid) {
|
||||
foreach ($params['userids'] as $userid) {
|
||||
if (!$assignment->revert_to_draft($userid)) {
|
||||
$detail = 'User id: ' . $userid . ', Assignment id: ' . $assignmentid;
|
||||
$warnings[] = self::generate_warning($assignmentid,
|
||||
$detail = 'User id: ' . $userid . ', Assignment id: ' . $params['assignmentid'];
|
||||
$warnings[] = self::generate_warning($params['assignmentid'],
|
||||
'couldnotrevert',
|
||||
$detail);
|
||||
}
|
||||
@@ -1335,16 +1337,17 @@ class mod_assign_external extends external_api {
|
||||
array('assignmentid' => $assignmentid,
|
||||
'userids' => $userids));
|
||||
|
||||
$cm = get_coursemodule_from_instance('assign', $assignmentid, 0, false, MUST_EXIST);
|
||||
$cm = get_coursemodule_from_instance('assign', $params['assignmentid'], 0, false, MUST_EXIST);
|
||||
$context = context_module::instance($cm->id);
|
||||
self::validate_context($context);
|
||||
|
||||
$assignment = new assign($context, $cm, null);
|
||||
|
||||
$warnings = array();
|
||||
foreach ($userids as $userid) {
|
||||
foreach ($params['userids'] as $userid) {
|
||||
if (!$assignment->unlock_submission($userid)) {
|
||||
$detail = 'User id: ' . $userid . ', Assignment id: ' . $assignmentid;
|
||||
$warnings[] = self::generate_warning($assignmentid,
|
||||
$detail = 'User id: ' . $userid . ', Assignment id: ' . $params['assignmentid'];
|
||||
$warnings[] = self::generate_warning($params['assignmentid'],
|
||||
'couldnotunlock',
|
||||
$detail);
|
||||
}
|
||||
@@ -1394,18 +1397,19 @@ class mod_assign_external extends external_api {
|
||||
array('assignmentid' => $assignmentid,
|
||||
'acceptsubmissionstatement' => $acceptsubmissionstatement));
|
||||
|
||||
$cm = get_coursemodule_from_instance('assign', $assignmentid, 0, false, MUST_EXIST);
|
||||
$cm = get_coursemodule_from_instance('assign', $params['assignmentid'], 0, false, MUST_EXIST);
|
||||
$context = context_module::instance($cm->id);
|
||||
self::validate_context($context);
|
||||
|
||||
$assignment = new assign($context, $cm, null);
|
||||
|
||||
$warnings = array();
|
||||
$data = new stdClass();
|
||||
$data->submissionstatement = $acceptsubmissionstatement;
|
||||
$data->submissionstatement = $params['acceptsubmissionstatement'];
|
||||
|
||||
if (!$assignment->submit_for_grading($data)) {
|
||||
$detail = 'User id: ' . $USER->id . ', Assignment id: ' . $assignmentid;
|
||||
$warnings[] = self::generate_warning($assignmentid,
|
||||
$detail = 'User id: ' . $USER->id . ', Assignment id: ' . $params['assignmentid'];
|
||||
$warnings[] = self::generate_warning($params['assignmentid'],
|
||||
'couldnotsubmitforgrading',
|
||||
$detail);
|
||||
}
|
||||
@@ -1464,26 +1468,27 @@ class mod_assign_external extends external_api {
|
||||
'userids' => $userids,
|
||||
'dates' => $dates));
|
||||
|
||||
if (count($userids) != count($dates)) {
|
||||
if (count($params['userids']) != count($params['dates'])) {
|
||||
$detail = 'Length of userids and dates parameters differ.';
|
||||
$warnings[] = self::generate_warning($assignmentid,
|
||||
$warnings[] = self::generate_warning($params['assignmentid'],
|
||||
'invalidparameters',
|
||||
$detail);
|
||||
|
||||
return $warnings;
|
||||
}
|
||||
|
||||
$cm = get_coursemodule_from_instance('assign', $assignmentid, 0, false, MUST_EXIST);
|
||||
$cm = get_coursemodule_from_instance('assign', $params['assignmentid'], 0, false, MUST_EXIST);
|
||||
$context = context_module::instance($cm->id);
|
||||
self::validate_context($context);
|
||||
|
||||
$assignment = new assign($context, $cm, null);
|
||||
|
||||
$warnings = array();
|
||||
foreach ($userids as $idx => $userid) {
|
||||
$duedate = $dates[$idx];
|
||||
foreach ($params['userids'] as $idx => $userid) {
|
||||
$duedate = $params['dates'][$idx];
|
||||
if (!$assignment->save_user_extension($userid, $duedate)) {
|
||||
$detail = 'User id: ' . $userid . ', Assignment id: ' . $assignmentid . ', Extension date: ' . $duedate;
|
||||
$warnings[] = self::generate_warning($assignmentid,
|
||||
$detail = 'User id: ' . $userid . ', Assignment id: ' . $params['assignmentid'] . ', Extension date: ' . $duedate;
|
||||
$warnings[] = self::generate_warning($params['assignmentid'],
|
||||
'couldnotgrantextensions',
|
||||
$detail);
|
||||
}
|
||||
@@ -1531,15 +1536,16 @@ class mod_assign_external extends external_api {
|
||||
$params = self::validate_parameters(self::reveal_identities_parameters(),
|
||||
array('assignmentid' => $assignmentid));
|
||||
|
||||
$cm = get_coursemodule_from_instance('assign', $assignmentid, 0, false, MUST_EXIST);
|
||||
$cm = get_coursemodule_from_instance('assign', $params['assignmentid'], 0, false, MUST_EXIST);
|
||||
$context = context_module::instance($cm->id);
|
||||
self::validate_context($context);
|
||||
|
||||
$assignment = new assign($context, $cm, null);
|
||||
|
||||
$warnings = array();
|
||||
if (!$assignment->reveal_identities()) {
|
||||
$detail = 'User id: ' . $USER->id . ', Assignment id: ' . $assignmentid;
|
||||
$warnings[] = self::generate_warning($assignmentid,
|
||||
$detail = 'User id: ' . $USER->id . ', Assignment id: ' . $params['assignmentid'];
|
||||
$warnings[] = self::generate_warning($params['assignmentid'],
|
||||
'couldnotrevealidentities',
|
||||
$detail);
|
||||
}
|
||||
@@ -1603,20 +1609,21 @@ class mod_assign_external extends external_api {
|
||||
array('assignmentid' => $assignmentid,
|
||||
'plugindata' => $plugindata));
|
||||
|
||||
$cm = get_coursemodule_from_instance('assign', $assignmentid, 0, false, MUST_EXIST);
|
||||
$cm = get_coursemodule_from_instance('assign', $params['assignmentid'], 0, false, MUST_EXIST);
|
||||
$context = context_module::instance($cm->id);
|
||||
self::validate_context($context);
|
||||
|
||||
$assignment = new assign($context, $cm, null);
|
||||
|
||||
$notices = array();
|
||||
|
||||
$submissiondata = (object)$plugindata;
|
||||
$submissiondata = (object)$params['plugindata'];
|
||||
|
||||
$assignment->save_submission($submissiondata, $notices);
|
||||
|
||||
$warnings = array();
|
||||
foreach ($notices as $notice) {
|
||||
$warnings[] = self::generate_warning($assignmentid,
|
||||
$warnings[] = self::generate_warning($params['assignmentid'],
|
||||
'couldnotsavesubmission',
|
||||
$notice);
|
||||
}
|
||||
@@ -1707,20 +1714,21 @@ class mod_assign_external extends external_api {
|
||||
'applytoall' => $applytoall,
|
||||
'plugindata' => $plugindata));
|
||||
|
||||
$cm = get_coursemodule_from_instance('assign', $assignmentid, 0, false, MUST_EXIST);
|
||||
$cm = get_coursemodule_from_instance('assign', $params['assignmentid'], 0, false, MUST_EXIST);
|
||||
$context = context_module::instance($cm->id);
|
||||
self::validate_context($context);
|
||||
|
||||
$assignment = new assign($context, $cm, null);
|
||||
|
||||
$gradedata = (object)$plugindata;
|
||||
$gradedata = (object)$params['plugindata'];
|
||||
|
||||
$gradedata->addattempt = $addattempt;
|
||||
$gradedata->attemptnumber = $attemptnumber;
|
||||
$gradedata->workflowstate = $workflowstate;
|
||||
$gradedata->applytoall = $applytoall;
|
||||
$gradedata->grade = $grade;
|
||||
$gradedata->addattempt = $params['addattempt'];
|
||||
$gradedata->attemptnumber = $params['attemptnumber'];
|
||||
$gradedata->workflowstate = $params['workflowstate'];
|
||||
$gradedata->applytoall = $params['applytoall'];
|
||||
$gradedata->grade = $params['grade'];
|
||||
|
||||
$assignment->save_grade($userid, $gradedata);
|
||||
$assignment->save_grade($params['userid'], $gradedata);
|
||||
|
||||
return null;
|
||||
}
|
||||
@@ -1764,6 +1772,7 @@ class mod_assign_external extends external_api {
|
||||
|
||||
$cm = get_coursemodule_from_instance('assign', $assignmentid, 0, false, MUST_EXIST);
|
||||
$context = context_module::instance($cm->id);
|
||||
self::validate_context($context);
|
||||
|
||||
$assignment = new assign($context, $cm, null);
|
||||
|
||||
|
||||
Reference in New Issue
Block a user