Just changing some parameters stuff to new functions...

See SC and Bug 1837

Merged from MOODLE_14_STABLE

diff --git a/mod/glossary/approve.php b/mod/glossary/approve.php
index 1abbcce53431f42325e0f9afaea524b9a206cee0..22ac3c27d3d8a2dabbe4dadc1692cfff9837dbc9 100644 (file)
--- a/mod/glossary/approve.php
+++ b/mod/glossary/approve.php
@@ -6,11 +6,8 @@
     require_variable($id);           // Course Module ID
     optional_variable($eid);         // Entry ID
 
-    optional_variable($mode,"approval");
-    optional_variable($hook,"ALL");
-
-    $mode = strip_tags(urldecode($mode));  //XSS 
-    $hook = strip_tags(urldecode($hook));  //XSS 
+    $mode = optional_param('mode','approval');
+    $hook = optional_param('hook','ALL');
 
     if (! $cm = get_record("course_modules", "id", $id)) {
         error("Course Module ID was incorrect");

diff --git a/mod/glossary/comment.php b/mod/glossary/comment.php
index d3d676be93fa6fadd3525858d000b14b26244870..5a2c8d2da33d70312361eae3931750e9866c14dc 100644 (file)
--- a/mod/glossary/comment.php
+++ b/mod/glossary/comment.php
@@ -8,10 +8,9 @@
     require_variable($eid);            // Entry ID
     optional_variable($cid,0);         // Comment ID
 
-    optional_variable($action,"add");     // Action to perform
     optional_variable($confirm,0);     // Confirm the action
 
-    $action = strip_tags(urldecode($action));  //XSS
+    $action = optional_param('action','add');
 
     $action = strtolower($action);
 

diff --git a/mod/glossary/deleteentry.php b/mod/glossary/deleteentry.php
index 43d36de1701a53aced0fa74677c0b44829c5a6f3..e1ea1fd1c55b4425e31897235ec4309df7652636 100644 (file)
--- a/mod/glossary/deleteentry.php
+++ b/mod/glossary/deleteentry.php
@@ -6,11 +6,9 @@
     require_variable($id);    // course module ID
     optional_variable($confirm);  // commit the operation?
     optional_variable($entry);  // entry id
-    require_variable($prevmode);  //  current frame
-    optional_variable($hook);         // pivot id 
 
-    $prevmode = strip_tags(urldecode($prevmode));  //XSS
-    $hook = strip_tags(urldecode($hook));  //XSS
+    $prevmode = required_param('prevmode');
+    $hook = optional_param('hook');
 
     $strglossary = get_string("modulename", "glossary");
     $strglossaries = get_string("modulenameplural", "glossary");

diff --git a/mod/glossary/edit.php b/mod/glossary/edit.php
index e3e958de37e4f1eeee86a84fee5ba574158d477d..56dbbe7acca36b5be96030610ff3ff0efff69d7a 100644 (file)
--- a/mod/glossary/edit.php
+++ b/mod/glossary/edit.php
@@ -9,11 +9,8 @@ require_variable($id);    // Course Module ID
 optional_variable($e);    // EntryID
 optional_variable($confirm,0);    // proceed. Edit the edtry
 
-optional_variable($mode);   // categories if by category?
-optional_variable($hook);    // CategoryID
-
-$mode = strip_tags(urldecode($mode));  //XSS
-$hook = strip_tags(urldecode($hook));  //XSS
+$mode = optional_param('mode'); // categories if by category?
+$hook = optional_param('hook'); // CategoryID
 
 if (! $cm = get_record("course_modules", "id", $id)) {
     error("Course Module ID was incorrect");

diff --git a/mod/glossary/editcategories.php b/mod/glossary/editcategories.php
index 8e0f567bac52dc609278e940566ca240455f7399..4bc94c8e035d9cd93ccf901b19aa2cb0b2b68def 100644 (file)
--- a/mod/glossary/editcategories.php
+++ b/mod/glossary/editcategories.php
@@ -6,9 +6,6 @@
     require_once("lib.php");
 
     require_variable($id);    // Course Module ID, or
-    optional_variable($mode);  // cat
-    optional_variable($hook,0);  // category ID
-    optional_variable($action);  // what to do
     optional_variable($usedynalink);  // category ID
     optional_variable($confirm);  // confirm the action
 
@@ -16,9 +13,9 @@
 
     $name = clean_text($name);
 
-    $action = strip_tags(urldecode($action));  //XSS
-    $hook = strip_tags(urldecode($hook));  //XSS
-    $mode = strip_tags(urldecode($mode));  //XSS
+    $action = optional_param('action'); // what to do
+    $hook   = optional_param('hook',0); // category ID
+    $mode   = optional_param('mode');   // cat
 
     $action = strtolower($action);
         

diff --git a/mod/glossary/exportentry.php b/mod/glossary/exportentry.php
index aa21966eca89e998a85d33587923939f35422d76..59c45f52a81a229f17b18066f6ad157500b64f9e 100644 (file)
--- a/mod/glossary/exportentry.php
+++ b/mod/glossary/exportentry.php
@@ -5,11 +5,9 @@
     require_variable($id);    // course module ID
     require_variable($entry);    // Entry ID
     optional_variable($confirm);     // confirmation
-    optional_variable($mode);
-    optional_variable($hook);
 
-    $hook = strip_tags(urldecode($hook));  //XSS
-    $mode = strip_tags(urldecode($mode));  //XSS
+    $hook = optional_param('hook');
+    $mode = optional_param('mode');
         
     global $THEME, $USER, $CFG;
 

diff --git a/mod/glossary/formats.php b/mod/glossary/formats.php
index f1fdc07a02e94909d4d5d6fd64e69cf557e16c85..c21860365323ecc5554ff26f94ad6f1191c96be1 100644 (file)
--- a/mod/glossary/formats.php
+++ b/mod/glossary/formats.php
@@ -6,9 +6,8 @@
     global $CFG, $THEME;
         
     require_variable($id);    
-    optional_variable($mode); 
   
-    $mode = strip_tags(urldecode($mode));  //XSS
+    $mode = optional_param('mode');
         
     require_login();
     if ( !isadmin() ) {

diff --git a/mod/glossary/print.php b/mod/glossary/print.php
index 326120cedd889884d6aa473e1ef8c8b21e95608b..1bd38bac7a2c6734571ba40e60876bc1bd35dec2 100644 (file)
--- a/mod/glossary/print.php
+++ b/mod/glossary/print.php
@@ -6,16 +6,13 @@
     require_once("lib.php");
     
     require_variable($id);                         // Course Module ID
-    require_variable($mode,"letter");              // mode to show the entries
-    optional_variable($hook,"ALL");                // what to show
-    optional_variable($sortkey,"UPDATE");          // Sorting key 
     optional_variable($sortorder,"asc");           // Sorting order 
     optional_variable($offset);                    // number of entries to bypass
     optional_variable($displayformat,-1); 
 
-    $mode = strip_tags(urldecode($mode));  //XSS
-    $hook = strip_tags(urldecode($hook));  //XSS
-    $sortkey = strip_tags(urldecode($sortkey));  //XSS
+    $mode    = required_param('mode');             // mode to show the entries
+    $hook    = optional_param('hook','ALL');       // what to show
+    $sortkey = optional_param('sortkey','UPDATE'); // Sorting key
 
     if (! $cm = get_record("course_modules", "id", $id)) {
         error("Course Module ID was incorrect");

diff --git a/mod/glossary/view.php b/mod/glossary/view.php
index b7496ec415f75265d692e22bcb7d20aebe17a9d2..9a3a7410097629ca6f28dac06e14803cde82308e 100644 (file)
--- a/mod/glossary/view.php
+++ b/mod/glossary/view.php
@@ -13,29 +13,15 @@
 
     optional_variable($tab,GLOSSARY_NO_VIEW); // browsing entries by categories?
 
-    optional_variable($mode,"");  // [ "term"   | "entry"  | "cat"     | "date" | 
-                                        //   "letter" | "search" | "author"  | "approval" ]
-    optional_variable($hook,"");  // the term, entry, cat, etc... to look for based on mode
-
-    optional_variable($fullsearch,0); // full search (concept and definition) when searching?
-
-    optional_variable($sortkey,"");    // Sorted view: 
-                                       //    [ CREATION | UPDATE | FIRSTNAME | LASTNAME |
-                                       //      concept | timecreated | ... ]
-    optional_variable($sortorder,"");  // it defines the order of the sorting (ASC or DESC)
-
-    optional_variable($offset,0);      // entries to bypass (for paging purpouses)
-
-    optional_variable($show,"");       // [ concept | alias ] => mode=term hook=$show
     optional_variable($displayformat,-1);  // override of the glossary display format
 
-    $mode = strip_tags(urldecode($mode));  //XSS
-    $hook = strip_tags(urldecode($hook));  //XSS
-    $fullsearch = strip_tags(urldecode($fullsearch));  //XSS
-    $sortkey = strip_tags(urldecode($sortkey));  //XSS
-    $sortorder = strip_tags(urldecode($sortorder));  //XSS
-    $offset = strip_tags(urldecode($offset));  //XSS
-    $show = strip_tags(urldecode($show));  //XSS
+    $mode       = optional_param('mode');        // term entry cat date letter search author approval
+    $hook       = optional_param('hook');        // the term, entry, cat, etc... to look for based on mode
+    $fullsearch = optional_param('fullsearch',0);// full search (concept and definition) when searching?
+    $sortkey    = optional_param('sortkey');     // Sorted view: CREATION | UPDATE | FIRSTNAME | LASTNAME...
+    $sortorder  = optional_param('sortorder');   // it defines the order of the sorting (ASC or DESC)
+    $offset     = optional_param('offset',0);    // entries to bypass (for paging purpouses)
+    $show       = optional_param('show');        // [ concept | alias ] => mode=term hook=$show
 
     if (!empty($id)) {
         if (! $cm = get_record("course_modules", "id", $id)) {