L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-81267 mod_data: Clean field type before inclusion

Browse Source 
* Filter out wrong field types when restoring or creating a field.
This commit is contained in:
Laurent David
2024-04-17 10:33:08 +02:00
committed by Sara Arjona
parent dadffe8989
commit ffa045e099
4 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod/data/backup/moodle2/restore_data_stepslib.php
+1
View File
@@ -87,6 +87,7 @@ class restore_data_activity_structure_step extends restore_activity_structure_st
$oldid = $data->id;
$data->dataid = $this->get_new_parentid('data');
$data->type = clean_param($data->type, PARAM_ALPHA);
// insert the data_fields record
$newitemid = $DB->insert_record('data_fields', $data);
mod/data/classes/local/importer/csv_entries_importer.php
+1
View File
@@ -103,6 +103,7 @@ class csv_entries_importer extends entries_importer {
unset($fieldnames[$id]); // To ensure the user provided content fields remain in the array once flipped.
} else {
$field = $rawfields[$name];
$field->type = clean_param($field->type, PARAM_ALPHA);
$filepath = "$CFG->dirroot/mod/data/field/$field->type/field.class.php";
if (!file_exists($filepath)) {
$errorfield .= "'$name' ";
mod/data/lib.php
+2
View File
@@ -1051,6 +1051,7 @@ function data_get_field_from_id($fieldid, $data){
function data_get_field_new($type, $data) {
global $CFG;
$type = clean_param($type, PARAM_ALPHA);
$filepath = $CFG->dirroot.'/mod/data/field/'.$type.'/field.class.php';
// It should never access this method if the subfield class doesn't exist.
if (!file_exists($filepath)) {
@@ -1078,6 +1079,7 @@ function data_get_field(stdClass $field, stdClass $data, ?stdClass $cm=null): da
if (!isset($field->type)) {
return new data_field_base($field);
}
$field->type = clean_param($field->type, PARAM_ALPHA);
$filepath = $CFG->dirroot.'/mod/data/field/'.$field->type.'/field.class.php';
if (!file_exists($filepath)) {
return new data_field_base($field);
mod/data/locallib.php
+2
View File
@@ -976,6 +976,7 @@ function data_get_tag_title_field($dataid) {
if ($field->addtemplateposition === false) {
continue;
}
$field->type = clean_param($field->type, PARAM_ALPHA);
$filepath = $CFG->dirroot . '/mod/data/field/' . $field->type . '/field.class.php';
if (!file_exists($filepath)) {
continue;
@@ -1019,6 +1020,7 @@ function data_get_tag_title_for_entry($field, $entry) {
if (!isset($field->type)) {
return null;
}
$field->type = clean_param($field->type, PARAM_ALPHA);
$filepath = $CFG->dirroot . '/mod/data/field/' . $field->type . '/field.class.php';
if (!file_exists($filepath)) {
return null;