fixed some long standing and some new problems and SC#249, please consider backportin...

diff --git a/mod/survey/details.php b/mod/survey/details.php
index 7860055160d44e2b823c1e14a778303e8ec0e61d..6104ef8edfdf64c63b104132f4eba68c77aba7e8 100644 (file)
--- a/mod/survey/details.php
+++ b/mod/survey/details.php
@@ -2,7 +2,7 @@
 
     require_once("../../config.php");
 
-    if ($form = data_submitted($destination)) {
+    if ($form = data_submitted($CFG->wwwroot.'/course/mod.php')) {
 
         if (! $course = get_record("course", "id", $form->course)) {
             error("This course doesn't exist");
@@ -19,7 +19,7 @@
 
         print_header_simple("$streditingasurvey", "",
                       "<a href=\"index.php?id=$course->id\">$strsurveys</a>".
-                      " -> $form->name ($streditingasurvey)");
+                      " -> ".stripslashes_safe($form->name)." ($streditingasurvey)");
 
         if (!$form->name or !$form->template) {
             error(get_string("filloutallfields"), $_SERVER["HTTP_REFERER"]);
@@ -27,10 +27,10 @@
 
         print_simple_box_start('center');
         ?>
-        <form name="form" method="post" action="<?php p($form->destination)?>">
+        <form name="form" method="post" action="<?php echo $CFG->wwwroot.'/course/mod.php'?>">
         <table cellpadding="5" align="center">
         <tr><td align="right" nowrap="nowrap"><b><?php print_string("name") ?>:</b></td>
-            <td><?php p($form->name) ?></a></td></tr>
+            <td><?php p($form->name, true) ?></a></td></tr>
 
         <tr valign="top">
             <td align="right" nowrap="nowrap">
@@ -44,16 +44,19 @@
             <td>
                 <textarea name="intro" rows="20" cols="50" wrap="virtual"><?php
                 if ($form->intro) {
-                    p($form->intro);
+                    p($form->intro, true);
                 } else {
                     $form->intro = get_field("survey", "intro", "id", $form->template);
                     $form->intro = get_string($form->intro, "survey");
-                    p($form->intro);
+                    p($form->intro, true);
                 }
                 ?></textarea>
             </td>
         </tr>
         </table>
+        <?php $form = stripslashes_safe($form);
+        // no db access using $form beyond this point!
+        ?>
         <input type="hidden" name="name"       value="<?php p($form->name) ?>" />
         <input type="hidden" name="template"   value="<?php p($form->template) ?>" />
 

diff --git a/mod/survey/download.php b/mod/survey/download.php
index 2e31f212ff68b5a68454ad68607b1f987e4184dc..51d8001a4feb5e3c071c28f22008c6a6babce823 100644 (file)
--- a/mod/survey/download.php
+++ b/mod/survey/download.php
@@ -44,6 +44,7 @@
     $questions = get_records_list("survey_questions", "id", $survey->questions);
     $order = explode(",", $survey->questions);
 
+    $virtualscales = false;
     foreach ($order as $key => $qid) {  // Do we have virtual scales?
         $question = $questions[$qid];
         if ($question->type < 0) {

diff --git a/mod/survey/lib.php b/mod/survey/lib.php
index c28e04fa05d6305203fb8ac42051f887bf36c33c..2c402991d12df3c098afa1575ffa24609d2b69b2 100644 (file)
--- a/mod/survey/lib.php
+++ b/mod/survey/lib.php
@@ -441,11 +441,11 @@ function survey_print_single($question) {
 
 
     if ($question->type == 0) {           // Plain text field
-        echo "<textarea rows=\"3\" cols=\"30\" name=\"$question->id\">$question->options</textarea>";
+        echo "<textarea rows=\"3\" cols=\"30\" name=\"q$question->id\">$question->options</textarea>";
 
     } else if ($question->type > 0) {     // Choose one of a number
         $strchoose = get_string("choose");
-        echo "<select name=\"$question->id\">";
+        echo "<select name=\"q$question->id\">";
         echo "<option value=\"0\" selected=\"selected\">$strchoose...</option>";
         $options = explode( ",", $question->options);
         foreach ($options as $key => $val) {

diff --git a/mod/survey/mod.html b/mod/survey/mod.html
index 2fc9128a6bc1ef41213a303d6a9082504a8c96d1..94cb351a0c42b5d801883526e3f300943ba5d598 100644 (file)
--- a/mod/survey/mod.html
+++ b/mod/survey/mod.html
@@ -39,8 +39,6 @@
 </table>
 <center>
 <input type="hidden" name="intro"   value="<?php p($form->intro) ?>" />
-<input type="hidden" name="destination"   value="<?php echo "$CFG->wwwroot/course/mod.php" ?>" />
-
 <input type="hidden" name="course"     value="<?php p($form->course) ?>" />
 <input type="hidden" name="sesskey"    value="<?php p($form->sesskey) ?>" />
 <input type="hidden" name="coursemodule"  value="<?php p($form->coursemodule) ?>" />

diff --git a/mod/survey/report.php b/mod/survey/report.php
index 27178a9d54e062d60de915cc0e5849f75fc47749..44e60566f9d7d60383ac1cea9badec9c59ecd379 100644 (file)
--- a/mod/survey/report.php
+++ b/mod/survey/report.php
@@ -5,10 +5,11 @@
 
 // Check that all the parameters have been provided.
 
-    $id      = required_param('id', PARAM_INT);    // Course Module ID
-    $action  = optional_param('action', '', PARAM_ALPHA);  // What to look at
-    $qid     = optional_param('qid', 0, PARAM_INT);  // Group ID
-    $student = optional_param('student', 0, PARAM_INT);  // Student ID
+    $id      = required_param('id', PARAM_INT);           // Course Module ID
+    $action  = optional_param('action', '', PARAM_ALPHA); // What to look at
+    $qid     = optional_param('qid', 0, PARAM_INT);       // Question ID
+    $student = optional_param('student', 0, PARAM_INT);   // Student ID
+    $notes   = optional_param('notes', '', PARAM_RAW);    // Save teachers notes
 
     if (! $cm = get_record("course_modules", "id", $id)) {
         error("Course Module ID was incorrect");
@@ -104,6 +105,8 @@
 
 /// Print the menu across the top
 
+    $virtualscales = false;
+
     switch ($action) {
 
       case "summary":
@@ -307,7 +310,7 @@
 
          print_heading(get_string("analysisof", "survey", fullname($user)));
 
-         if (isset($notes)) {
+         if ($notes != '' and confirm_sesskey()) {
              if (survey_get_analysis($survey->id, $user->id)) {
                  if (! survey_update_analysis($survey->id, $user->id, $notes)) {
                      notify("An error occurred while saving your notes.  Sorry.");
@@ -369,7 +372,7 @@
                      $table = NULL;
                      $table->head = array(get_string($question->text, "survey"));
                      $table->align = array ("left");
-                     $table->data[] = array("$answer->answer1");
+                     $table->data[] = array(s($answer->answer1)); // no html here, just plain text
                      print_table($table);
                      print_spacer(30);
                  }
@@ -390,6 +393,7 @@
          p($notes);
          echo "</textarea><br />";
          echo "<input type=\"hidden\" name=\"action\" value=\"student\" />";
+         echo "<input type=\"hidden\" name=\"sesskey\" value=\"".sesskey()."\" />";
          echo "<input type=\"hidden\" name=\"student\" value=\"$student\" />";
          echo "<input type=\"hidden\" name=\"id\" value=\"$cm->id\" />";
          echo "<input type=\"submit\" value=\"".get_string("savechanges")."\" />";

diff --git a/mod/survey/save.php b/mod/survey/save.php
index ac10167912ab84acd3fc26904d340bda85bb5350..ec5547658bfc45486fb79c295df5a47aecdbb718 100644 (file)
--- a/mod/survey/save.php
+++ b/mod/survey/save.php
@@ -47,10 +47,10 @@
     foreach ($formdata as $key => $val) {
         if ($key <> "userid" && $key <> "id") {
             if ( substr($key,0,1) == "q") {
-                $key = substr($key,1);   // keep everything but the 'q'
+                $key = clean_param(substr($key,1), PARAM_ALPHANUM);   // keep everything but the 'q', number or Pnumber
             }
             if ( substr($key,0,1) == "P") {
-                $realkey = substr($key,1);
+                $realkey = (int) substr($key,1);
                 $answers[$realkey][1] = $val;
             } else {
                 $answers[$key][0] = $val;

diff --git a/mod/survey/view.php b/mod/survey/view.php
index dcecf8f6ca59363b04f7ed584a2f6012d36e54ac..8e903a8628f77119d2c8eb26f4653271017d5e82 100644 (file)
--- a/mod/survey/view.php
+++ b/mod/survey/view.php
@@ -84,7 +84,7 @@
                         $table = NULL;
                         $table->head = array(get_string($question->text, "survey"));
                         $table->align = array ("left");
-                        $table->data[] = array("$answer->answer1");
+                        $table->data[] = array(s($answer->answer1));//no html here, just plain text
                         print_table($table);
                         print_spacer(30);
                     }