MDL-18058 glossary rates - secured ; merged from 19_STABLE

diff --git a/lang/en_utf8/glossary.php b/lang/en_utf8/glossary.php
index 167f33afb26728c3df51809f10c85afcfb260a96..c426781ce6028f3b984e0c87306235fae970a642 100644 (file)
--- a/lang/en_utf8/glossary.php
+++ b/lang/en_utf8/glossary.php
@@ -147,6 +147,7 @@ $string['importentriesfromxml'] = 'Import entries from XML file';
 $string['includegroupbreaks'] = 'Include group breaks';
 $string['invalidid'] = 'Incorrect glossary id';
 $string['invalidglossaryformat'] = 'Invalid Glossary Format';
+$string['invalidrate'] = 'Invalid glossary rate ($a)';
 $string['isglobal'] = 'Is this glossary global?';
 $string['letter'] = 'letter';
 $string['linkcategory'] = 'Automatically link this category';

diff --git a/mod/glossary/rate.php b/mod/glossary/rate.php
index 14375131c7bde9b380e36a980ccf61200761a77a..2523422b4072513067ec110d23387d10392e9170 100644 (file)
--- a/mod/glossary/rate.php
+++ b/mod/glossary/rate.php
@@ -45,10 +45,15 @@
     }
 
     if ($data = data_submitted()) {    // form submitted
+
+    /// Calculate scale values
+        $scale_values = make_grades_menu($glossary->scale);
+
         foreach ((array)$data as $entryid => $rating) {
             if (!is_numeric($entryid)) {
                 continue;
             }
+
             if (!$entry = $DB->get_record('glossary_entries', array('id'=>$entryid))) {
                 continue;
             }
@@ -69,6 +74,11 @@
                 continue;
             }
 
+        /// Check rate is valid for that glossary scale values
+            if (!array_key_exists($rating, $scale_values) && $rating != -999) {
+                print_error('invalidrate', 'glossary', '', $rating);
+            }
+
             if ($oldrating = $DB->get_record("glossary_ratings", array("userid"=>$USER->id, "entryid"=>$entry->id))) {
                 //Check if we must delete the rate
                 if ($rating == -999) {