general cleanup of xxx_parameter() functions + other minor fixes

diff --git a/course/importstudents.php b/course/importstudents.php
index 184ad064d34fd426ef393df51adc3d10e4b0339e..f19a28529a97a5b38447169ce074a172769d0110 100644 (file)
--- a/course/importstudents.php
+++ b/course/importstudents.php
@@ -1,17 +1,19 @@
-<?php
+<?php //  $Id$
 // script to assign students to a meta course by selecting which courses the meta course comprises.
 // this is basically a hack of student.php that uses courses instead.
 
-
     require_once("../config.php");
     require_once("lib.php");
- 
+
     define("MAX_COURSES_PER_PAGE", 1000);
 
-    $id = required_param('id',PARAM_INT);         // course id
-    $add = optional_param('add', '', PARAM_ALPHA);
-    $remove = optional_param('remove', '', PARAM_ALPHA);
-    $search = optional_param('search', '', PARAM_ALPHA); // search string
+    $id             = required_param('id',PARAM_INT); // course id
+    $add            = optional_param('add', 0, PARAM_BOOL);
+    $remove         = optional_param('remove', 0, PARAM_BOOL);
+    $showall        = optional_param('showall', 0, PARAM_BOOL);
+    $searchtext     = optional_param('searchtext', '', PARAM_RAW); // search string
+    $previoussearch = optional_param('previoussearch', 0, PARAM_BOOL);
+    $previoussearch = ($searchtext != '') or ($previoussearch) ? 1:0;
 
     if (! $site = get_site()) {
         redirect("$CFG->wwwroot/$CFG->admin/index.php");
@@ -26,7 +28,7 @@
     if (!$course->metacourse) {
         redirect("$CFG->wwwroot/course/student.php?id=$course->id");
     }
-    
+
     if (!isadmin() && !isteacheredit($course->id)) {
         error("You must be an admin or a teacher of this course");
     }
@@ -44,9 +46,9 @@
     $strcourses   = get_string("courses");
     $strshowall = get_string("showall");
 
-    print_header("$course->shortname: $strassigncourses", 
-                 "$site->fullname", 
-                 "<a href=\"view.php?id=$course->id\">$course->shortname</a> -> $strassigncourses", 
+    print_header("$course->shortname: $strassigncourses",
+                 "$site->fullname",
+                 "<a href=\"view.php?id=$course->id\">$course->shortname</a> -> $strassigncourses",
                  "studentform.searchtext");
 
 /// Don't allow restricted teachers to even see this page (because it contains
@@ -57,37 +59,37 @@
 /// Print a help notice about the need to use this page
 
     if (!$frm = data_submitted()) {
-        $note = get_string("importmetacoursenote");   
+        $note = get_string("importmetacoursenote");
         print_simple_box($note, "center", "50%");
 
 /// A form was submitted so process the input
 
     } else {
-        if (!empty($frm->add) and !empty($frm->addselect) and confirm_sesskey()) {
+        if ($add and !empty($frm->addselect) and confirm_sesskey()) {
             $timestart = $timeend = 0;
             foreach ($frm->addselect as $addcourse) {
+                $addcourse = clean_param($addcourse, PARAM_INT);
                 set_time_limit(10);
                 if (!add_to_metacourse($course->id,$addcourse)) {
                     error("Could not add the selected course to this meta course!");
                 }
             }
-        } else if (!empty($frm->remove) and !empty($frm->removeselect) and confirm_sesskey()) {
+        } else if ($remove and !empty($frm->removeselect) and confirm_sesskey()) {
             foreach ($frm->removeselect as $removecourse) {
                 set_time_limit(10);
+                $removecourse = clean_param($removecourse, PARAM_INT);
                 if (! remove_from_metacourse($course->id,$removecourse)) {
                     error("Could not remove the selected course from this meta course!");
                 }
             }
-        } else if (!empty($frm->showall) and confirm_sesskey()) {
-            unset($frm->searchtext);
-            $frm->previoussearch = 0;
+        } else if ($showall and confirm_sesskey()) {
+            $searchtext = '';
+            $previoussearch = 0;
         }
     }
-    
 
-    $previoussearch = (is_object($frm) && ((!empty($frm->search) or ($frm->previoussearch == 1)))) ;
 
-    /// Get all existing students and teachers for this course.
+/// Get all existing students and teachers for this course.
     if(! $alreadycourses = get_courses_in_metacourse($course->id)) {
         $alreadycourses = array();
     }
@@ -96,25 +98,26 @@
 
 
 /// Get search results excluding any users already in this course
-    if (!empty($frm->searchtext) and $previoussearch and confirm_sesskey()) {
-        $searchcourses = get_courses_search(explode(" ",$frm->searchtext),'fullname ASC',0,99999,$numcourses);
-        foreach ($searchcourses as $tmp) {
-            if (array_key_exists($tmp->id,$alreadycourses)) {
-                unset($searchcourses[$tmp->id]);
+    if (($searchtext != '') and $previoussearch and confirm_sesskey()) {
+        if ($searchcourses = get_courses_search(explode(" ",$searchtext),'fullname ASC',0,99999,$numcourses)) {
+            foreach ($searchcourses as $tmp) {
+                if (array_key_exists($tmp->id,$alreadycourses)) {
+                    unset($searchcourses[$tmp->id]);
+                }
+                if (!empty($tmp->metacourse)) {
+                    unset($searchcourses[$tmp->id]);
+                }
             }
-            if (!empty($tmp->metacourse)) {
-                unset($searchcourses[$tmp->id]);
+            if (array_key_exists($course->id,$searchcourses)) {
+                unset($searchcourses[$course->id]);
             }
+            $numcourses = count($searchcourses);
         }
-        if (array_key_exists($course->id,$searchcourses)) {
-            unset($searchcourses[$course->id]);
-        }
-        $numcourses = count($searchcourses);
     }
-    
+
 /// If no search results then get potential students for this course excluding users already in course
     if (empty($searchcourses)) {
-        
+
         $numcourses = get_courses_notin_metacourse($course->id,true);
 
         $courses = array();
@@ -125,9 +128,6 @@
     }
 
 
-    $searchtext = (isset($frm->searchtext)) ? $frm->searchtext : "";
-    $previoussearch = ($previoussearch) ? '1' : '0';
-
     print_simple_box_start("center");
 
     include('importstudents.html');
@@ -136,8 +136,4 @@
 
     print_footer();
 
-
-
-
-
 ?>

diff --git a/course/student.html b/course/student.html
index e9ebdb12848ca8d1ed3c42c65ec60d48dfda7f37..b9e23c87070d25613c512ad3b1d9d750c4a7d0a1 100644 (file)
--- a/course/student.html
+++ b/course/student.html
@@ -1,7 +1,7 @@
 
 <form name="studentform" id="studentform" method="post" action="student.php">
 <input type="hidden" name="previoussearch" value="<?php echo $previoussearch ?>" />
-<input type="hidden" name="sesskey" value="<?php echo $sesskey ?>" />
+<input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
 <input type="hidden" name="id" value="<?php echo $course->id ?>" />
   <table align="center" border="0" cellpadding="5" cellspacing="0">
     <tr>

diff --git a/course/student.php b/course/student.php
index 85c7efd54e15bb3842fca082c3a5b94924dd0307..3afd18f3ee5fc5b443025ddccde279cb4350fb21 100644 (file)
--- a/course/student.php
+++ b/course/student.php
@@ -5,10 +5,13 @@
 
     define("MAX_USERS_PER_PAGE", 5000);
 
-    $id = required_param('id',PARAM_INT); // course id
-    $add = optional_param('add', "", PARAM_ALPHA);
-    $remove = optional_param('remove', "", PARAM_ALPHA);
-    $search = optional_param('search', "", PARAM_CLEAN); // search string
+    $id             = required_param('id',PARAM_INT); // course id
+    $add            = optional_param('add', 0, PARAM_BOOL);
+    $remove         = optional_param('remove', 0, PARAM_BOOL);
+    $showall        = optional_param('showall', 0, PARAM_BOOL);
+    $searchtext     = optional_param('searchtext', '', PARAM_RAW); // search string
+    $previoussearch = optional_param('previoussearch', 0, PARAM_BOOL);
+    $previoussearch = ($searchtext != '') or ($previoussearch) ? 1:0;
 
     if (! $site = get_site()) {
         redirect("$CFG->wwwroot/$CFG->admin/index.php");
@@ -71,7 +74,7 @@
 /// A form was submitted so process the input
 
     } else {
-        if (!empty($frm->add) and !empty($frm->addselect) and confirm_sesskey()) {
+        if ($add and !empty($frm->addselect) and confirm_sesskey()) {
             if ($course->enrolperiod) {
                 $timestart = time();
                 $timeend   = $timestart + $course->enrolperiod;
@@ -79,23 +82,24 @@
                 $timestart = $timeend = 0;
             }
             foreach ($frm->addselect as $addstudent) {
+                $addstudent = clean_param($addstudent, PARAM_INT);
                 if (! enrol_student($addstudent, $course->id, $timestart, $timeend)) {
                     error("Could not add student with id $addstudent to this course!");
                 }
             }
-        } else if (!empty($frm->remove) and !empty($frm->removeselect) and confirm_sesskey()) {
+        } else if ($remove and !empty($frm->removeselect) and confirm_sesskey()) {
             foreach ($frm->removeselect as $removestudent) {
+                $removestudent = clean_param($removestudent, PARAM_INT);
                 if (! unenrol_student($removestudent, $course->id)) {
                     error("Could not remove student with id $removestudent from this course!");
                 }
             }
-        } else if (!empty($frm->showall)) {
-            unset($frm->searchtext);
-            $frm->previoussearch = 0;
+        } else if ($showall) {
+            $searchtext = '';
+            $previoussearch = 0;
         }
     }
 
-    $previoussearch = (!empty($frm) && (!empty($frm->search) or ($frm->previoussearch == 1))) ;
 
 /// Get all existing students and teachers for this course.
     if (!$students = get_course_students($course->id, "u.firstname ASC, u.lastname ASC", "", 0, 99999,
@@ -118,8 +122,8 @@
 
 
 /// Get search results excluding any users already in this course
-    if (!empty($frm->searchtext) and $previoussearch) {
-        $searchusers = get_users(true, $frm->searchtext, true, $existinguserlist, 'firstname ASC, lastname ASC',
+    if (($searchtext != '') and $previoussearch) {
+        $searchusers = get_users(true, $searchtext, true, $existinguserlist, 'firstname ASC, lastname ASC',
                                       '', '', 0, 99999, 'id, firstname, lastname, email');
         $usercount = get_users(false, '', true, $existinguserlist);
     }
@@ -139,13 +143,8 @@
     }
 
 
-    $searchtext = (isset($frm->searchtext)) ? $frm->searchtext : "";
-    $previoussearch = ($previoussearch) ? '1' : '0';
-
     print_simple_box_start("center");
 
-    $sesskey = !empty($USER->id) ? $USER->sesskey : '';
-
     include('student.html');
 
     print_simple_box_end();