L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-22015 String identifiers are now validated, coding exception thrown otherwise

Browse Source
This commit is contained in:
David Mudrak
2010-04-28 00:06:43 +00:00
parent 2d0f7da8f8
commit fe6a248f5a
2 changed files with 33 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/moodlelib.php
+18
View File
@@ -229,6 +229,10 @@ define('PARAM_URL', 'url');
*/
define('PARAM_USERNAME', 'username');
/**
* PARAM_STRINGID - used to check if the given string is valid string identifier for get_string()
*/
define('PARAM_STRINGID', 'stringid');
///// DEPRECATED PARAM TYPES OR ALIASES - DO NOT USE FOR NEW CODE /////
/**
@@ -515,6 +519,7 @@ function validate_param($param, $type, $allownull=NULL_NOT_ALLOWED, $debuginfo='
* @uses PARAM_TAG
* @uses PARAM_SEQUENCE
* @uses PARAM_USERNAME
* @uses PARAM_STRINGID
* @param mixed $param the variable we are cleaning
* @param int $type expected format of param after cleaning.
* @return mixed
@@ -790,6 +795,13 @@ function clean_param($param, $type) {
return '';
}
case PARAM_STRINGID:
if (preg_match('|^[a-zA-Z][a-zA-Z0-9\.:/_-]*$|', $param)) {
return $param;
} else {
return '';
}
default: // throw error, switched parameters in optional_param or another serious problem
print_error("unknownparamtype", '', '', $type);
}
@@ -6470,6 +6482,12 @@ class install_string_manager implements string_manager {
* @return string The localized string.
*/
function get_string($identifier, $component = '', $a = NULL) {
$identifier = clean_param($identifier, PARAM_STRINGID);
if (empty($identifier)) {
throw new coding_exception('Invalid string identifier. Most probably some illegal character is part of the string identifier. Please fix your get_string() call and string definition');
}
if (func_num_args() > 3) {
debugging('extralocations parameter in get_string() is not supported any more, please use standard lang locations only.');
}
lib/simpletest/testmoodlelib.php
+15
View File
@@ -267,6 +267,7 @@ class moodlelib_test extends UnitTestCase {
* @uses PARAM_CLEANHTML
* @uses PARAM_SEQUENCE
* @uses PARAM_USERNAME
* @uses PARAM_STRINGID
* @param mixed $param the variable we are cleaning
* @param int $type expected format of param after cleaning.
* @return mixed
@@ -325,6 +326,20 @@ class moodlelib_test extends UnitTestCase {
$this->assertEqual(clean_param('johndóé ', PARAM_USERNAME), 'johndóé');
$CFG->extendedusernamechars = $currentstatus;
// Test string identifiers validation
// valid strings:
$this->assertEqual(clean_param('validstring', PARAM_STRINGID), 'validstring');
$this->assertEqual(clean_param('mod/foobar:valid_capability', PARAM_STRINGID), 'mod/foobar:valid_capability');
$this->assertEqual(clean_param('CZ', PARAM_STRINGID), 'CZ');
$this->assertEqual(clean_param('application/vnd.ms-powerpoint', PARAM_STRINGID), 'application/vnd.ms-powerpoint');
$this->assertEqual(clean_param('grade2', PARAM_STRINGID), 'grade2');
// invalid strings:
$this->assertEqual(clean_param('trailing ', PARAM_STRINGID), '');
$this->assertEqual(clean_param('space bar', PARAM_STRINGID), '');
$this->assertEqual(clean_param('0numeric', PARAM_STRINGID), '');
$this->assertEqual(clean_param('*', PARAM_STRINGID), '');
$this->assertEqual(clean_param(' ', PARAM_STRINGID), '');
}
function test_validate_param() {