From f96b8a1c67f4a106fb7fa78b4338f3c35973f1da Mon Sep 17 00:00:00 2001
From: Frederic Massart <fred@moodle.com>
Date: Tue, 28 Jan 2014 15:18:18 +0800
Subject: [PATCH] MDL-43468 mod_assign: Webservice parameters were not safely
 cleaned

---
 mod/assign/externallib.php | 83 +++++++++++++++++++++-----------------
 1 file changed, 46 insertions(+), 37 deletions(-)

diff --git a/mod/assign/externallib.php b/mod/assign/externallib.php
index cf582ce86d8..1ba0daae873 100644
--- a/mod/assign/externallib.php
+++ b/mod/assign/externallib.php
@@ -1209,16 +1209,17 @@ class mod_assign_external extends external_api {
                         array('assignmentid' => $assignmentid,
                               'userids' => $userids));
 
-        $cm = get_coursemodule_from_instance('assign', $assignmentid, 0, false, MUST_EXIST);
+        $cm = get_coursemodule_from_instance('assign', $params['assignmentid'], 0, false, MUST_EXIST);
         $context = context_module::instance($cm->id);
+        self::validate_context($context);
 
         $assignment = new assign($context, $cm, null);
 
         $warnings = array();
-        foreach ($userids as $userid) {
+        foreach ($params['userids'] as $userid) {
             if (!$assignment->lock_submission($userid)) {
-                $detail = 'User id: ' . $userid . ', Assignment id: ' . $assignmentid;
-                $warnings[] = self::generate_warning($assignmentid,
+                $detail = 'User id: ' . $userid . ', Assignment id: ' . $params['assignmentid'];
+                $warnings[] = self::generate_warning($params['assignmentid'],
                                                      'couldnotlock',
                                                      $detail);
             }
@@ -1272,16 +1273,17 @@ class mod_assign_external extends external_api {
                         array('assignmentid' => $assignmentid,
                               'userids' => $userids));
 
-        $cm = get_coursemodule_from_instance('assign', $assignmentid, 0, false, MUST_EXIST);
+        $cm = get_coursemodule_from_instance('assign', $params['assignmentid'], 0, false, MUST_EXIST);
         $context = context_module::instance($cm->id);
+        self::validate_context($context);
 
         $assignment = new assign($context, $cm, null);
 
         $warnings = array();
-        foreach ($userids as $userid) {
+        foreach ($params['userids'] as $userid) {
             if (!$assignment->revert_to_draft($userid)) {
-                $detail = 'User id: ' . $userid . ', Assignment id: ' . $assignmentid;
-                $warnings[] = self::generate_warning($assignmentid,
+                $detail = 'User id: ' . $userid . ', Assignment id: ' . $params['assignmentid'];
+                $warnings[] = self::generate_warning($params['assignmentid'],
                                                      'couldnotrevert',
                                                      $detail);
             }
@@ -1335,16 +1337,17 @@ class mod_assign_external extends external_api {
                         array('assignmentid' => $assignmentid,
                               'userids' => $userids));
 
-        $cm = get_coursemodule_from_instance('assign', $assignmentid, 0, false, MUST_EXIST);
+        $cm = get_coursemodule_from_instance('assign', $params['assignmentid'], 0, false, MUST_EXIST);
         $context = context_module::instance($cm->id);
+        self::validate_context($context);
 
         $assignment = new assign($context, $cm, null);
 
         $warnings = array();
-        foreach ($userids as $userid) {
+        foreach ($params['userids'] as $userid) {
             if (!$assignment->unlock_submission($userid)) {
-                $detail = 'User id: ' . $userid . ', Assignment id: ' . $assignmentid;
-                $warnings[] = self::generate_warning($assignmentid,
+                $detail = 'User id: ' . $userid . ', Assignment id: ' . $params['assignmentid'];
+                $warnings[] = self::generate_warning($params['assignmentid'],
                                                      'couldnotunlock',
                                                      $detail);
             }
@@ -1394,18 +1397,19 @@ class mod_assign_external extends external_api {
                                             array('assignmentid' => $assignmentid,
                                                   'acceptsubmissionstatement' => $acceptsubmissionstatement));
 
-        $cm = get_coursemodule_from_instance('assign', $assignmentid, 0, false, MUST_EXIST);
+        $cm = get_coursemodule_from_instance('assign', $params['assignmentid'], 0, false, MUST_EXIST);
         $context = context_module::instance($cm->id);
+        self::validate_context($context);
 
         $assignment = new assign($context, $cm, null);
 
         $warnings = array();
         $data = new stdClass();
-        $data->submissionstatement = $acceptsubmissionstatement;
+        $data->submissionstatement = $params['acceptsubmissionstatement'];
 
         if (!$assignment->submit_for_grading($data)) {
-            $detail = 'User id: ' . $USER->id . ', Assignment id: ' . $assignmentid;
-            $warnings[] = self::generate_warning($assignmentid,
+            $detail = 'User id: ' . $USER->id . ', Assignment id: ' . $params['assignmentid'];
+            $warnings[] = self::generate_warning($params['assignmentid'],
                                                  'couldnotsubmitforgrading',
                                                  $detail);
         }
@@ -1464,26 +1468,27 @@ class mod_assign_external extends external_api {
                               'userids' => $userids,
                               'dates' => $dates));
 
-        if (count($userids) != count($dates)) {
+        if (count($params['userids']) != count($params['dates'])) {
             $detail = 'Length of userids and dates parameters differ.';
-            $warnings[] = self::generate_warning($assignmentid,
+            $warnings[] = self::generate_warning($params['assignmentid'],
                                                  'invalidparameters',
                                                  $detail);
 
             return $warnings;
         }
 
-        $cm = get_coursemodule_from_instance('assign', $assignmentid, 0, false, MUST_EXIST);
+        $cm = get_coursemodule_from_instance('assign', $params['assignmentid'], 0, false, MUST_EXIST);
         $context = context_module::instance($cm->id);
+        self::validate_context($context);
 
         $assignment = new assign($context, $cm, null);
 
         $warnings = array();
-        foreach ($userids as $idx => $userid) {
-            $duedate = $dates[$idx];
+        foreach ($params['userids'] as $idx => $userid) {
+            $duedate = $params['dates'][$idx];
             if (!$assignment->save_user_extension($userid, $duedate)) {
-                $detail = 'User id: ' . $userid . ', Assignment id: ' . $assignmentid . ', Extension date: ' . $duedate;
-                $warnings[] = self::generate_warning($assignmentid,
+                $detail = 'User id: ' . $userid . ', Assignment id: ' . $params['assignmentid'] . ', Extension date: ' . $duedate;
+                $warnings[] = self::generate_warning($params['assignmentid'],
                                                      'couldnotgrantextensions',
                                                      $detail);
             }
@@ -1531,15 +1536,16 @@ class mod_assign_external extends external_api {
         $params = self::validate_parameters(self::reveal_identities_parameters(),
                                             array('assignmentid' => $assignmentid));
 
-        $cm = get_coursemodule_from_instance('assign', $assignmentid, 0, false, MUST_EXIST);
+        $cm = get_coursemodule_from_instance('assign', $params['assignmentid'], 0, false, MUST_EXIST);
         $context = context_module::instance($cm->id);
+        self::validate_context($context);
 
         $assignment = new assign($context, $cm, null);
 
         $warnings = array();
         if (!$assignment->reveal_identities()) {
-            $detail = 'User id: ' . $USER->id . ', Assignment id: ' . $assignmentid;
-            $warnings[] = self::generate_warning($assignmentid,
+            $detail = 'User id: ' . $USER->id . ', Assignment id: ' . $params['assignmentid'];
+            $warnings[] = self::generate_warning($params['assignmentid'],
                                                  'couldnotrevealidentities',
                                                  $detail);
         }
@@ -1603,20 +1609,21 @@ class mod_assign_external extends external_api {
                                             array('assignmentid' => $assignmentid,
                                                   'plugindata' => $plugindata));
 
-        $cm = get_coursemodule_from_instance('assign', $assignmentid, 0, false, MUST_EXIST);
+        $cm = get_coursemodule_from_instance('assign', $params['assignmentid'], 0, false, MUST_EXIST);
         $context = context_module::instance($cm->id);
+        self::validate_context($context);
 
         $assignment = new assign($context, $cm, null);
 
         $notices = array();
 
-        $submissiondata = (object)$plugindata;
+        $submissiondata = (object)$params['plugindata'];
 
         $assignment->save_submission($submissiondata, $notices);
 
         $warnings = array();
         foreach ($notices as $notice) {
-            $warnings[] = self::generate_warning($assignmentid,
+            $warnings[] = self::generate_warning($params['assignmentid'],
                                                  'couldnotsavesubmission',
                                                  $notice);
         }
@@ -1707,20 +1714,21 @@ class mod_assign_external extends external_api {
                                                   'applytoall' => $applytoall,
                                                   'plugindata' => $plugindata));
 
-        $cm = get_coursemodule_from_instance('assign', $assignmentid, 0, false, MUST_EXIST);
+        $cm = get_coursemodule_from_instance('assign', $params['assignmentid'], 0, false, MUST_EXIST);
         $context = context_module::instance($cm->id);
+        self::validate_context($context);
 
         $assignment = new assign($context, $cm, null);
 
-        $gradedata = (object)$plugindata;
+        $gradedata = (object)$params['plugindata'];
 
-        $gradedata->addattempt = $addattempt;
-        $gradedata->attemptnumber = $attemptnumber;
-        $gradedata->workflowstate = $workflowstate;
-        $gradedata->applytoall = $applytoall;
-        $gradedata->grade = $grade;
+        $gradedata->addattempt = $params['addattempt'];
+        $gradedata->attemptnumber = $params['attemptnumber'];
+        $gradedata->workflowstate = $params['workflowstate'];
+        $gradedata->applytoall = $params['applytoall'];
+        $gradedata->grade = $params['grade'];
 
-        $assignment->save_grade($userid, $gradedata);
+        $assignment->save_grade($params['userid'], $gradedata);
 
         return null;
     }
@@ -1764,6 +1772,7 @@ class mod_assign_external extends external_api {
 
         $cm = get_coursemodule_from_instance('assign', $assignmentid, 0, false, MUST_EXIST);
         $context = context_module::instance($cm->id);
+        self::validate_context($context);
 
         $assignment = new assign($context, $cm, null);