Correct construction of SQL clauses (fix for SC#20).

Improved conformance with the new _param() functions a bit.

diff --git a/calendar/lib.php b/calendar/lib.php
index 6b3634c92f09d1241bb3391244cc90b6b7e561cf..87bfb8ef1fe2113e3200d457c8a8a8a90af3f6d0 100644 (file)
--- a/calendar/lib.php
+++ b/calendar/lib.php
@@ -388,6 +388,7 @@ function calendar_sql_where($tstart, $tend, $users, $groups, $courses, $withdura
     if(is_bool($users) && is_bool($groups) && is_bool($courses)) {
         return false;
     }
+
     if(is_array($users) && !empty($users)) {
         // Events from a number of users
         if(!empty($whereclause)) $whereclause .= ' OR';
@@ -407,6 +408,7 @@ function calendar_sql_where($tstart, $tend, $users, $groups, $courses, $withdura
         // No user at all
         // No need to do anything
     }
+
     if(is_array($groups) && !empty($groups)) {
         // Events from a number of groups
         if(!empty($whereclause)) $whereclause .= ' OR';
@@ -422,6 +424,8 @@ function calendar_sql_where($tstart, $tend, $users, $groups, $courses, $withdura
         if(!empty($whereclause)) $whereclause .= ' OR ';
         $whereclause .= ' groupid != 0';
     }
+    // boolean false (no groups at all): we don't need to do anything
+
     if(is_array($courses)) {
         // A number of courses (maybe none at all!)
         if(!empty($courses)) {
@@ -446,6 +450,14 @@ function calendar_sql_where($tstart, $tend, $users, $groups, $courses, $withdura
         $whereclause .= ' groupid = 0 AND courseid != 0';
     }
 
+    // Security check: if, by now, we have NOTHING in $whereclause, then it means
+    // that NO event-selecting clauses were defined. Thus, we won't be returning ANY
+    // events no matter what. Allowing the code to proceed might return a completely
+    // valid query with only time constraints, thus selecting ALL events in that time frame!
+    if(empty($whereclause)) {
+        return false;
+    }
+
     if ($ignorehidden) {
         if (!empty($whereclause)) $whereclause .= ' AND';
         $whereclause .= ' visible = 1';

diff --git a/calendar/view.php b/calendar/view.php
index 4107d78f07003e025652dac1b6029242a075d3f9..a12992e7f61e8d4e018d77ea2fc87a085a3465c0 100644 (file)
--- a/calendar/view.php
+++ b/calendar/view.php
@@ -44,11 +44,7 @@
     require_once($CFG->dirroot.'/course/lib.php');
     require_once($CFG->dirroot.'/calendar/lib.php');
 
-    optional_variable($_GET['view'], 'upcoming');
     optional_variable($_GET['course'], 0);
-    optional_variable($_GET['cal_d']);
-    optional_variable($_GET['cal_m']);
-    optional_variable($_GET['cal_y']);
 
     if(!$site = get_site()) {
         redirect($CFG->wwwroot.'/'.$CFG->admin.'/index.php');
@@ -60,10 +56,14 @@
 
     $nav = calendar_get_link_tag(get_string('calendar', 'calendar'), CALENDAR_URL.'view.php?view=upcoming&', $now['mday'], $now['mon'], $now['year']);
 
-    // Make sure that the GET variables are correct
-    $day = intval($_GET['cal_d']);
-    $mon = intval($_GET['cal_m']);
-    $yr = intval($_GET['cal_y']);
+    optional_param('view', 'upcoming');
+    optional_param('cal_d', 0, PARAM_INT);
+    optional_param('cal_m', 0, PARAM_INT);
+    optional_param('cal_y', 0, PARAM_INT);
+    $day = $cal_d;
+    $mon = $cal_m;
+    $yr  = $cal_y;
+    
     if(!checkdate($mon, $day, $yr)) {
         $day = intval($now['mday']);
         $mon = intval($now['mon']);
@@ -71,7 +71,7 @@
     }
     $time = mktime(0, 0, 0, $mon, $day, $yr);
 
-    switch($_GET['view']) {
+    switch($view) {
         case 'day':
             $text = strftime(get_string('strftimedate'), $time);
             if($text[0] == '0') {
@@ -139,7 +139,7 @@
 
     echo '<td style="vertical-align: top; width: 100%;">';
 
-    switch($_GET['view']) {
+    switch($view) {
         case 'day':
             calendar_show_day($day, $mon, $yr, $courses, $groups, $users);
         break;
@@ -161,7 +161,7 @@
     list($prevmon, $prevyr) = calendar_sub_month($mon, $yr);
     list($nextmon, $nextyr) = calendar_add_month($mon, $yr);
     $getvars = 'cal_d='.$day.'&amp;cal_m='.$mon.'&amp;cal_y='.$yr; // For filtering
-    echo calendar_filter_controls($_GET['view'], $getvars);
+    echo calendar_filter_controls($view, $getvars);
     echo '<div style="margin: 10px 0px;">';
     echo calendar_top_controls('display', array('m' => $prevmon, 'y' => $prevyr));
     echo calendar_get_mini($courses, $groups, $users, $prevmon, $prevyr);