_params and other cleaning, blogs might be broken

diff --git a/blog/edit.html b/blog/edit.html
index 900a9a5f99c9fe7ad12b7f27133c7f78cc036855..251d475e797b45819b139d36d0d54c1b6773aac2 100755 (executable)
--- a/blog/edit.html
+++ b/blog/edit.html
@@ -52,12 +52,12 @@
 </tr>
 <tr>
     <td>
-    <b>Official Tags</b>
+    <b><?php print_string('otags','blog'); ?></b>
     </td>
     
     
     <td>
-    <b>User Defined Tags</b>
+    <b><?php print_string('ptags','blog'); ?></b>
     </td>
 </tr>
 
@@ -76,7 +76,7 @@
     ?>
     </select>
     </td>
-
+    
     <td>
     <select name="ptags[]" multiple="multiple" size="8">
     <?php
@@ -96,7 +96,7 @@
 <tr>
     <td>
     <?php
-    link_to_popup_window($CFG->wwwroot."/blog/tags.php",'popup',get_string('tagmanagement'));
+    link_to_popup_window("/blog/tags.php",'popup',get_string('tagmanagement'));
     ?>
     </td>
 </tr>
@@ -138,7 +138,7 @@
         print_textarea($usehtmleditor, 6, 60, 600, 500, 'body', $post->body, $post->courseid); ?>
     </td>
 </tr>
-<?php  
+<?php
     if (isset($post->useextendedbody) && $post->useextendedbody) {
         print '<tr valign=top>'."\n";
         print '<td align=right><strong>'."\n";
@@ -149,7 +149,7 @@
         print '<br />'."\n";
         print_textarea($usehtmleditor, 25, 60, 600, 500, 'extendedbody', $post->extendedbody, $post->courseid);
         print '</td></tr>';
-   } else { 
+   } else {
         print '<input type="hidden" name="extendedbody" value="" />';
    }
 
@@ -171,18 +171,12 @@
     <td align="center" colspan="3">
         <input type="hidden" name="editform" value="1" id="editform" />
         <input type="hidden" name="courseid" value="<?php p($post->courseid) ?>" id="courseid" />
-        <?php 
-            //groups not supported quite yet - pseudocode:        
-            /*if ( isset($post->groupid) ) {
-                print '<input type="hidden" name="groupid" value="'. p($post->groupid) .'" />';
-            }*/
-        ?>
         <input type="hidden" name="userid" value="<?php p($post->userid) ?>" id="userid" />
         <input type="hidden" name="userid" value="<?php echo $userid; ?>" id="userid" />
         <input type="hidden" name="tem" id="tem" />
 <?php
     if (isset($post->postid) && ($post->postid != -1) ) {
-    ?>
+?>
         <input type="hidden" name="postid" value="<?php echo $post->postid; ?>" id="postid" />
         <input type="hidden" name="act" value="update" id="act" />
         <input type="submit" value="Update" id="Submit1" name="Submit1" />&nbsp;

diff --git a/blog/edit.php b/blog/edit.php
index 94c4e0c16b5dfe104b5150bce56dc862f7f997b7..c2dc5037db2159aad22c2387fe5637d990e4c4cb 100755 (executable)
--- a/blog/edit.php
+++ b/blog/edit.php
@@ -16,8 +16,8 @@ if (isguest()) {
     error(get_string('noguestpost', 'forum'), $referrer);
 }
 
-$userid = optional_param('userid', 0);
-$editid = optional_param('editid', '');
+$userid = optional_param('userid', 0, PARAM_INT);
+$editid = optional_param('editid', 0, PARAM_INT);
 
 global $USER, $CFG;
 
@@ -228,8 +228,9 @@ function do_save(&$post, &$bloginfo_arg) {
 
 //        print 'Debug: created a new entry - entryId = '.$entryID.'<br />'; //debug
 //        echo 'Debug: do_save() in edit.php calling blog_do_*back_pings<br />'."\n"; //debug
-        $otags = optional_param('otags');
-        $ptags = optional_param('ptags');
+        $otags = optional_param('otags','', PARAM_INT);
+        $ptags = optional_param('ptags','', PARAM_INT);
+
         // Add tags information
         foreach ($otags as $otag) {
             $tag->entryid = $entryID;
@@ -312,8 +313,8 @@ function do_update(&$post, &$bloginfo) {
 //        echo 'Debug: do_update in edit.php calling do_pings<br />'."\n"; //debug
         delete_records('blog_tag_instance', 'entryid', $blogentry->entryId);
 
-        $otags = optional_param('otags');
-        $ptags = optional_param('ptags');
+        $otags = optional_param('otags','', PARAM_INT);
+        $ptags = optional_param('ptags','', PARAM_INT);
         // Add tags information
         foreach ($otags as $otag) {
             $tag->entryid = $blogentry->entryId;

diff --git a/blog/header.php b/blog/header.php
index 72b4d655fe6893d1ef530497280e50e1b3c8ef50..f4c30e649688c566dd6eb66c1f0341e6c53e88e5 100755 (executable)
--- a/blog/header.php
+++ b/blog/header.php
@@ -8,18 +8,12 @@ require_once($CFG->dirroot .'/blog/blogpage.php');
 require_once($CFG->libdir .'/blocklib.php');
 require_once($CFG->dirroot .'/course/lib.php');
 
-$blockaction = optional_param('blockaction');
+$blockaction = optional_param('blockaction','', PARAM_ALPHA);
 $instanceid = optional_param('instanceid', 0, PARAM_INT);
 $blockid = optional_param('blockid',    0, PARAM_INT);
 $groupid = optional_param('groupid',    0, PARAM_INT);
 $userid = optional_param('userid',     0, PARAM_INT);
 
-$pageTitle = optional_param('pageTitle');
-$pageHeading = optional_param('pageHeading'/*$site->fullname*/);
-$pageFocus = optional_param('pageFocus');
-$pageMeta = optional_param('pageMeta');
-$pageNavigation = optional_param('pageNavigation');
-
 if (!isset($courseid)) {
     $courseid = optional_param('courseid', SITEID, PARAM_INT);
 }
@@ -134,7 +128,7 @@ switch ($filtertype) {
                         '<a href="'.$CFG->wwwroot.'/course/view.php?id='.$course->id.'">'.$course->shortname.'</a> ->
                         <a href="'.$CFG->wwwroot.'/user/index.php?id='.$course->id.'">'.$participants.'</a> ->
                         <a href="'.$CFG->wwwroot.'/user/view.php?id='.$filterselect.'&amp;course='.$course->id.'">'.fullname($user).'</a> ->
-                        <a href="index.php?courseid='.optional_param('courseid').'&amp;filtertype=user&amp;filterselect='.$filterselect.'">'. "$blogstring</a> -> $tagstring: $taginstance->text",'','',true,$PAGE->get_extra_header_string());
+                        <a href="index.php?courseid='.optional_param('courseid', 0, PARAM_INT).'&amp;filtertype=user&amp;filterselect='.$filterselect.'">'. "$blogstring</a> -> $tagstring: $taginstance->text",'','',true,$PAGE->get_extra_header_string());
 
             } else {
                 print_header("$course->shortname: $blogstring", "$course->fullname",
@@ -177,8 +171,8 @@ if ($PAGE->user_allowed_editing()) {
 }
 
 // Calculate the preferred width for left, right and center (both center positions will use the same)
-$preferred_width_left = optional_param('preferred_width_left',  blocks_preferred_width($pageblocks[BLOCK_POS_LEFT]));
-$preferred_width_right = optional_param('preferred_width_right', blocks_preferred_width($pageblocks[BLOCK_POS_RIGHT]));
+$preferred_width_left = optional_param('preferred_width_left',  blocks_preferred_width($pageblocks[BLOCK_POS_LEFT]), PARAM_INT);
+$preferred_width_right = optional_param('preferred_width_right', blocks_preferred_width($pageblocks[BLOCK_POS_RIGHT]), PARAM_INT);
 $preferred_width_left = min($preferred_width_left, BLOCK_L_MAX_WIDTH);
 $preferred_width_left = max($preferred_width_left, BLOCK_L_MIN_WIDTH);
 $preferred_width_right = min($preferred_width_right, BLOCK_R_MAX_WIDTH);

diff --git a/blog/index.php b/blog/index.php
index 750c8a83fec9def3d5eaf0a24f995b24f6b8edd4..5b0b3480434c8781ceae714891f0c176c08c4ef2 100755 (executable)
--- a/blog/index.php
+++ b/blog/index.php
@@ -15,20 +15,18 @@ require_once('../config.php');
 require_once($CFG->dirroot .'/blog/lib.php');
 require_once($CFG->libdir .'/blocklib.php');
 
-$id = optional_param('id');
-$limit = optional_param('limit');
-$formstart = optional_param('formstart', 'none');
-$m = optional_param('m', ''); //month
-$y = optional_param('y', ''); //year
-$d = optional_param('d', ''); //day
-$limit = optional_param('limit', 'none');
-$formstart = optional_param('formstart', 'none');
+$id = optional_param('id', 0, PARAM_INT);
+$limit = optional_param('limit', 0, PARAM_INT);
+$formstart = optional_param('formstart', 'none', PARAM_ALPHA);
+$m = optional_param('m', 0, PARAM_INT); //month
+$y = optional_param('y', 0, PARAM_INT); //year
+$d = optional_param('d', 0, PARAM_INT); //day
 
 $userid = optional_param('userid',0,PARAM_INT);
 $groupid = optional_param('groupid',0,PARAM_INT);
 $courseid = optional_param('courseid',0,PARAM_INT);
-$tag = optional_param('tag');
-$tagid = optional_param('tagid');
+$tag = urldecode(optional_param('tag', '', PARAM_NOTAGS));
+$tagid = optional_param('tagid', 0, PARAM_INT);
 
 $filtertype = optional_param('filtertype', '', PARAM_ALPHA);
 $filterselect = optional_param('filterselect', 0, PARAM_INT);

diff --git a/blog/lib.php b/blog/lib.php
index 06ba4be105c2276b7a019715db3546e82c9b23ea..06bbb308772ee01c43216f4c66ea5c067b1fcf2f 100755 (executable)
--- a/blog/lib.php
+++ b/blog/lib.php
@@ -596,7 +596,7 @@ function blog_get_course_selection_popup($courseid='') {
  */
 function blog_print_html_formatted_entries(&$blogFilter, $filtertype, $filterselect) {
     global $CFG, $USER;
-    $blogpage = optional_param('blogpage', 0);
+    $blogpage = optional_param('blogpage', 0, PARAM_INT);
     $bloglimit = get_user_preferences('blogpagesize',8); // expose as user pref when MyMoodle comes around
 
     // First let's see if the batchpublish form has submitted data

diff --git a/blog/preferences.php b/blog/preferences.php
index e7613137b7a4c0a0ace85df2080a20027eb81383..d9823f9bd6be67c37c5fef3a96ca72d7ef5e93c1 100755 (executable)
--- a/blog/preferences.php
+++ b/blog/preferences.php
@@ -30,7 +30,7 @@
        if ($post = data_submitted()) {
         print_header();
 
-        set_user_preference('blogpagesize', optional_param('pagesize'));
+        set_user_preference('blogpagesize', optional_param('pagesize', 10, PARAM_INT));
         
         redirect($referrer, get_string('changessaved'), 1);
         exit;

diff --git a/blog/set_session_vars.php b/blog/set_session_vars.php
index 8af24efecd6de0931e1ef4ff5e6491c3031363c3..ea104fdf70a928a78f1a0ac4c3f66a74eef826d8 100644 (file)
--- a/blog/set_session_vars.php
+++ b/blog/set_session_vars.php
@@ -4,15 +4,15 @@
     require_once('../config.php');
     require_once('lib.php');
 
-    $referrer = required_param('referrer');
-    $var = required_param('var');
-    $value = optional_param('value');
-    $userid = optional_param('userid');
-    $courseid = optional_param('courseid');
-    $d = optional_param('d');
-    $m = optional_param('m');
-    $y = optional_param('y');
-    $id = optional_param('id');
+    $referrer = required_param('referrer', PARAM_NOTAGS);
+    $var = required_param('var',PARAM_ALPHA);
+    $value = optional_param('value','', PARAM_NOTAGS);
+    $userid = optional_param('userid',0 , PARAM_INT);
+    $courseid = optional_param('courseid',0, PARAM_INT);
+    $d = optional_param('d', 0, PARAM_INT);
+    $m = optional_param('m', 0, PARAM_INT);
+    $y = optional_param('y', 0, PARAM_INT);
+    $id = optional_param('id', 0, PARAM_INT);
 
     switch($var) {
         case 'setcourse':

diff --git a/blog/tags.php b/blog/tags.php
index 8be4d8f459be70f32807bcfe7ed23a16828f93b0..c8cd7b57cc97ec979a65600e1fc309b55602490e 100755 (executable)
--- a/blog/tags.php
+++ b/blog/tags.php
@@ -12,7 +12,7 @@ switch ($mode) {
             die('you can not add official tags');
         }
         
-        if (($otag = optional_param('otag')) && (!get_record('tags','text',$otag))) {
+        if (($otag = optional_param('otag', '', PARAM_ALPHA)) && (!get_record('tags','text',$otag))) {
             $tag->userid = $USER->id;
             $tag->text = $otag;
             $tag->type = 'official';
@@ -34,7 +34,7 @@ switch ($mode) {
             error ('you can not add tags');
         }
         
-        if (($ptag = optional_param('ptag')) && (!get_record('tags','text',$ptag))) {
+        if (($ptag = optional_param('ptag', '', PARAM_ALPHA)) && (!get_record('tags','text',$ptag))) {
             $tag->userid = $USER->id;
             $tag->text = $ptag;
             $tag->type = 'personal';
@@ -56,45 +56,46 @@ switch ($mode) {
             error('you can not delete tags');
         }
         
-        $tags = optional_param('tags');
-        print_object($tags);
-        foreach ($tags as $tag) {
-
-            $blogtag = get_record('tags','id',$tag);
-            
-            if (!isadmin() and $USER->id != $blogtag->userid) {
-                notify('no right to delete');
-                continue;
-            }
-            
-            /// Only admin can delete tags that are referenced
-            if (!isadmin() && get_records('blog_tag_instance','tagid', $tag)) {
-                notify('tag is used by other users, can not delete!');
-                continue;
-            }
-            
-            delete_records('tags','id',$tag);
-            delete_records('blog_tag_instance', 'tagid', $tag);
-
-            /// remove parent window option via javascript
-            echo '<script>
-            var i=0;
-            while (i < window.opener.document.entry[\'otags[]\'].length) {
-                if (window.opener.document.entry[\'otags[]\'].options[i].value == '.$tag.') {
-                    window.opener.document.entry[\'otags[]\'].removeChild(opener.document.entry[\'otags[]\'].options[i]);
+        if ($tags = optional_param('tags', 0, PARAM_INT)) {
+        
+            foreach ($tags as $tag) {
+
+                $blogtag = get_record('tags','id',$tag);
+
+                if (!isadmin() and $USER->id != $blogtag->userid) {
+                    notify('no right to delete');
+                    continue;
                 }
-                i++;
-            }
-            
-            var i=0;
-            while (i < window.opener.document.entry[\'ptags[]\'].length) {
-                if (window.opener.document.entry[\'ptags[]\'].options[i].value == '.$tag.') {
-                    window.opener.document.entry[\'ptags[]\'].removeChild(opener.document.entry[\'ptags[]\'].options[i]);
+
+                /// Only admin can delete tags that are referenced
+                if (!isadmin() && get_records('blog_tag_instance','tagid', $tag)) {
+                    notify('tag is used by other users, can not delete!');
+                    continue;
                 }
-                i++;
-            }
 
-            </script>';
+                delete_records('tags','id',$tag);
+                delete_records('blog_tag_instance', 'tagid', $tag);
+
+                /// remove parent window option via javascript
+                echo '<script>
+                var i=0;
+                while (i < window.opener.document.entry[\'otags[]\'].length) {
+                    if (window.opener.document.entry[\'otags[]\'].options[i].value == '.$tag.') {
+                        window.opener.document.entry[\'otags[]\'].removeChild(opener.document.entry[\'otags[]\'].options[i]);
+                    }
+                    i++;
+                }
+
+                var i=0;
+                while (i < window.opener.document.entry[\'ptags[]\'].length) {
+                    if (window.opener.document.entry[\'ptags[]\'].options[i].value == '.$tag.') {
+                        window.opener.document.entry[\'ptags[]\'].removeChild(opener.document.entry[\'ptags[]\'].options[i]);
+                    }
+                    i++;
+                }
+
+                </script>';
+            }
         }
         //write back to window.opener
     break;