MDL-17050 excorising $_POST - thanks to mikec for patch - also check groupmode befor...

diff --git a/mod/choice/report.php b/mod/choice/report.php
index a4e3f11355b2c0773cf6db5c32011fbe2acdd6ba..1d752409716b6f5d3ea9818a1029fc6812489c33 100644 (file)
--- a/mod/choice/report.php
+++ b/mod/choice/report.php
@@ -3,10 +3,11 @@
     require_once("../../config.php");
     require_once("lib.php");
 
-    $id       = required_param('id', PARAM_INT);   //moduleid
-    $format   = optional_param('format', CHOICE_PUBLISH_NAMES, PARAM_INT);
-    $download = optional_param('download', '', PARAM_ALPHA);
-    $action   = optional_param('action', '', PARAM_ALPHA);
+    $id         = required_param('id', PARAM_INT);   //moduleid
+    $format     = optional_param('format', CHOICE_PUBLISH_NAMES, PARAM_INT);
+    $download   = optional_param('download', '', PARAM_ALPHA);
+    $action     = optional_param('action', '', PARAM_ALPHA);
+    $attemptids = optional_param('attemptid', array(), PARAM_INT); //get array of responses to delete.
 
     if (! $cm = get_coursemodule_from_id('choice', $id)) {
         print_error("invalidcoursemodule");
@@ -33,7 +34,6 @@
     add_to_log($course->id, "choice", "report", "report.php?id=$cm->id", "$choice->id",$cm->id);
 
     if ($action == 'delete' && has_capability('mod/choice:deleteresponses',$context)) {
-        $attemptids = isset($_POST['attemptid']) ? $_POST['attemptid'] : array(); //get array of repsonses to delete.
         choice_delete_responses($attemptids, $choice->id); //delete responses.
         redirect("report.php?id=$cm->id");
     }
@@ -45,8 +45,10 @@
                   update_module_button($cm->id, $course->id, $strchoice), navmenu($course, $cm));
         /// Check to see if groups are being used in this choice
         $groupmode = groups_get_activity_groupmode($cm);
-        groups_get_activity_group($cm, true);
-        groups_print_activity_menu($cm, 'report.php?id='.$id);
+        if ($groupmode) {
+            groups_get_activity_group($cm, true);
+            groups_print_activity_menu($cm, 'report.php?id='.$id);
+        }
     } else {
         $groupmode = groups_get_activity_groupmode($cm);
     }