MDL-9123:

Check that the selected category is allowed.

Merged from STABLE_18

diff --git a/question/import.php b/question/import.php
index 476f524a3d01616c7b80da8d4bde55a9127cffd3..782f0e640387120aee1c1f54d097d8e42f94f149 100644 (file)
--- a/question/import.php
+++ b/question/import.php
@@ -62,10 +62,14 @@
         print_error('nocategory','quiz');
     }
 
-    if (!$courseid) { // need to get the course from the chosen category
-        $courseid = $category->course;
+    // check category is valid (against THIS courseid, before we change it)
+    $validcats = question_category_options( $courseid, true, true );
+    if (!array_key_exists( $categoryid, $validcats )) {
+        print_error( 'invalidcategory', 'quiz' );
     }
 
+    $courseid = $category->course;
+
     if (!$course = get_record("course", "id", $courseid)) {
         error("Invalid course!");
     }