variable cleaning and sesskey updates

diff --git a/mod/lesson/import.php b/mod/lesson/import.php
index 5d2ab45b9ae8e7134f296647b9a4be4725ffb477..4fa31e53e5b5cadd0ad108ef505752c5ba6b44bf 100644 (file)
--- a/mod/lesson/import.php
+++ b/mod/lesson/import.php
@@ -4,8 +4,9 @@
     require_once("../../config.php");
        require_once("locallib.php");
 
-    optional_variable($format);
-    require_variable($id);    // Course Module ID
+    $format = optional_param('format');
+    $id = required_param('id', PARAM_INT);    // Course Module ID
+       $pageid = required_param('pageid', PARAM_INT);
 
     if (! $cm = get_record("course_modules", "id", $id)) {
         error("Course Module ID was incorrect");
@@ -33,8 +34,8 @@
                  "<A HREF=\"$CFG->wwwroot/course/view.php?id=$course->id\">$course->shortname</A> -> ". 
                  "<A HREF=index.php?id=$course->id>$strlessons</A> -> <a href=\"view.php?id=$cm->id\">$lesson->name</a>-> $strimportquestions");
 
-    if ($form = data_submitted()) {   /// Filename
-
+    if ($form = lesson_clean_data_submitted()) {   /// Filename
+               confirm_sesskey();
         $form->format = clean_filename($form->format); // For safety
 
         if (isset($form->filename)) {                 // file already on server
@@ -78,7 +79,7 @@
                 error("Error occurred during pre-processing!");
             }
 
-            if (! $format->importprocess($newfile['tmp_name'], $lesson, $_POST['pageid'])) {    // Process the uploaded file
+            if (! $format->importprocess($newfile['tmp_name'], $lesson, $pageid)) {    // Process the uploaded file
                 error("Error occurred during processing!");
             }
 
@@ -112,7 +113,8 @@
     print_simple_box_start("center", "", "$THEME->cellheading");
     echo "<form enctype=\"multipart/form-data\" method=\"post\" action=import.php>";
     echo "<input type=\"hidden\" name=\"id\" value=\"$cm->id\">\n";
-    echo "<input type=\"hidden\" name=\"pageid\" value=\"".$_GET['pageid']."\">\n";
+    echo "<input type=\"hidden\" name=\"pageid\" value=\"".$pageid."\">\n";
+       echo "<input type=\"hidden\" name=\"sesskey\" value=\"".$USER->sesskey."\">\n";
     echo "<table cellpadding=5>";
 
     echo "<tr><td align=right>";

diff --git a/mod/lesson/lesson.php b/mod/lesson/lesson.php
index 7d693fea0a119129f827dcb4666a7b593d24ae24..0241fe0520d67ba27c7461e79680a2520ae0baba 100644 (file)
--- a/mod/lesson/lesson.php
+++ b/mod/lesson/lesson.php
@@ -102,6 +102,7 @@
         <input type="hidden" name="action" value="insertpage">
         <input type="hidden" name="pageid" value="<?PHP echo $pageid ?>" />
         <input type="hidden" name="qtype" value="<?PHP echo LESSON_BRANCHTABLE ?>" />
+               <input type="hidden" name="sesskey" value="<?PHP echo $USER->sesskey ?>" />
         <center><table cellpadding=5 border=1>
         <tr><td align="center">
         <tr valign="top">
@@ -156,6 +157,8 @@
                error("Only teachers can look at this page");
            }
 
+               confirm_sesskey();
+
         // first get the preceeding page
         $pageid = required_param('pageid', PARAM_INT);
             
@@ -218,6 +221,8 @@
                if (!isteacher($course->id)) {
                error("Only teachers can look at this page");
            }
+               
+               confirm_sesskey();
 
         // first get the preceeding page
                // if $pageid = 0, then we are inserting a new page at the beginning of the lesson
@@ -285,6 +290,8 @@
                error("Only teachers can look at this page");
            }
 
+               confirm_sesskey();
+
         // first get the preceeding page
         $pageid = required_param('pageid', PARAM_INT);
             
@@ -379,17 +386,19 @@
         <input type="hidden" name="id" value="<?PHP echo $cm->id ?>">
         <input type="hidden" name="action" value="insertpage">
         <input type="hidden" name="pageid" value="<?PHP echo $pageid ?>">
+        <input type="hidden" name="sesskey" value="<?PHP echo $USER->sesskey ?>">
                <center><table cellpadding=5 border=1>
                <?php
                    echo "<tr><td align=\"center\"><b>";
                        echo get_string("questiontype", "lesson").":</b> \n";
                        echo helpbutton("questiontype", get_string("questiontype", "lesson"), "lesson")."<br>";
                        if (isset($_GET['qtype'])) {
-                               lesson_qtype_menu($LESSON_QUESTION_TYPE, $_GET['qtype'], 
+                               $qtype = clean_param($_GET['qtype'], PARAM_INT);
+                               lesson_qtype_menu($LESSON_QUESTION_TYPE, $qtype, 
                                                                  "lesson.php?id=$cm->id&action=addpage&pageid=".$pageid.$linkadd);
                                // NoticeFix rearraged
-                               if ( $_GET['qtype'] == LESSON_SHORTANSWER || $_GET['qtype'] == LESSON_MULTICHOICE || !isset($_GET['qtype']) ) {  // only display this option for Multichoice and shortanswer
-                                       if ($_GET['qtype'] == LESSON_SHORTANSWER) {
+                               if ( $qtype == LESSON_SHORTANSWER || $qtype == LESSON_MULTICHOICE ) {  // only display this option for Multichoice and shortanswer
+                                       if ($qtype == LESSON_SHORTANSWER) {
                                                echo "<br><br><b>".get_string("casesensitive", "lesson").":</b> \n";
                                        } else {
                                                echo "<br><br><b>".get_string("multianswer", "lesson").":</b> \n";
@@ -576,6 +585,8 @@
                if (!isteacher($course->id)) {
                error("Only teachers can look at this page");
            }
+               
+               confirm_sesskey();
 
         $pageid = required_param('pageid', PARAM_INT);
         if (!$thispage = get_record("lesson_pages", "id", $pageid)) {
@@ -594,13 +605,16 @@
             }
         }
                notice_yesno(get_string("confirmdeletionofthispage","lesson"), 
-                        "lesson.php?action=delete&amp;id=$cm->id&amp;pageid=$pageid", 
+                        "lesson.php?action=delete&amp;id=$cm->id&amp;pageid=$pageid&amp;sesskey=".$USER->sesskey, 
              "view.php?id=$cm->id");
                }
        
 
        /****************** continue ************************************/
        elseif ($action == 'continue' ) {
+
+               confirm_sesskey();
+
                //CDC Chris Berri added this echo call for left menu.  must match that in view.php for styles
                if ($lesson->displayleft) {
                        echo '<div class="leftmenu1">'; 
@@ -1420,6 +1434,8 @@
                if (!isteacher($course->id)) {
                error("Only teachers can look at this page");
            }
+               
+               confirm_sesskey();
 
                if (empty($_GET['pageid'])) {
                        error("Delete: pageid missing");
@@ -1532,6 +1548,7 @@
         <input type="hidden" name="id" value="<?PHP echo $cm->id ?>">
         <input type="hidden" name="action" value="updatepage">
         <input type="hidden" name="pageid" value="<?PHP echo $pageid ?>">
+        <input type="hidden" name="sesskey" value="<?PHP echo $USER->sesskey ?>">              
         <input type="hidden" name="redisplay" value="0">
         <center><table cellpadding=5 border=1>
                <?php
@@ -1922,7 +1939,7 @@
                                                lesson_choose_from_menu($jump, "jumpto[$i]", 0, "");
                                                helpbutton("jumpto", get_string("jump", "lesson"), "lesson");
                                                if($lesson->custom) {
-                                                       echo get_string("score", "lesson")." $iplus1: <input type=\"text\" name=\"score[$i]\" value=\"-1\" size=\"5\">";
+                                                       echo get_string("score", "lesson")." $iplus1: <input type=\"text\" name=\"score[$i]\" value=\"0\" size=\"5\">";
                                                }
                                                echo "</td></tr>\n";
                                                break;
@@ -1955,6 +1972,8 @@
                error("Only teachers can look at this page");
            }
 
+               confirm_sesskey();
+
         $timenow = time();
                
                $form = lesson_clean_data_submitted();
@@ -2153,7 +2172,7 @@
         }
 
         echo "<center><table cellpadding=\"5\" border=\"1\">\n";
-        echo "<tr><td><a href=\"lesson.php?id=$cm->id&amp;action=moveit&amp;pageid=$pageid&amp;after=0\"><small>".
+        echo "<tr><td><a href=\"lesson.php?id=$cm->id&amp;sesskey=".$USER->sesskey."&amp;action=moveit&amp;pageid=$pageid&amp;after=0\"><small>".
             get_string("movepagehere", "lesson")."</small></a></td></tr>\n";
         while (true) {
             if ($page->id != $pageid) {
@@ -2161,7 +2180,7 @@
                     $title = "<< ".get_string("notitle", "lesson")."  >>";
                 }
                 echo "<tr><td bgcolor=\"$THEME->cellheading2\"><b>$title</b></td></tr>\n";
-                echo "<tr><td><a href=\"lesson.php?id=$cm->id&amp;action=moveit&amp;pageid=$pageid&amp;after={$page->id}\"><small>".
+                echo "<tr><td><a href=\"lesson.php?id=$cm->id&amp;sesskey=".$USER->sesskey."&amp;action=moveit&amp;pageid=$pageid&amp;after={$page->id}\"><small>".
                     get_string("movepagehere", "lesson")."</small></a></td></tr>\n";
             }
             if ($page->nextpageid) {
@@ -2184,6 +2203,8 @@
                error("Only teachers can look at this page");
            }
 
+               confirm_sesskey();
+
         $pageid = required_param('pageid', PARAM_INT); //  page to move
         if (!$page = get_record("lesson_pages", "id", $pageid)) {
             error("Moveit: page not found");
@@ -2285,6 +2306,8 @@
                error("Only teachers can look at this page");
            }
 
+               confirm_sesskey();
+
         $timenow = time();
                $form = lesson_clean_data_submitted();
 

diff --git a/mod/lesson/view.php b/mod/lesson/view.php
index 827a4c7a3240e8de0aad22ae30607dc335f981b0..6d871d27640bffe4fcd730632e0ae7fcd78524c4 100644 (file)
--- a/mod/lesson/view.php
+++ b/mod/lesson/view.php
@@ -7,8 +7,8 @@
     require_once('locallib.php');
     require_once('lib.php');
 
-    require_variable($id);    // Course Module ID
-    optional_variable($pageid);    // Lesson Page ID
+    $id = required_param('id', PARAM_INT);    // Course Module ID
+    $pageid = optional_param('pageid', NULL, PARAM_INT);    // Lesson Page ID
 
     if (! $cm = get_record('course_modules', 'id', $id)) {
         error('Course Module ID was incorrect');
@@ -74,7 +74,7 @@
     if (isteacheredit($course->id)) {
         $button = '<table><tr><td>';
         $button .= '<form target="'. $CFG->framename .'" method="get" action="'. $CFG->wwwroot .'/course/mod.php">'.
-               '<input type="hidden" name="sesskey" value="'. $USER->sesskey .'" />'.          
+               '<input type="hidden" name="sesskey" value="'. $USER->sesskey .'" />'.
                '<input type="hidden" name="update" value="'. $cm->id .'" />'.
                '<input type="hidden" name="return" value="true" />'.
                '<input type="submit" value="'. get_string('editlessonsettings', 'lesson') .'" /></form>';
@@ -136,7 +136,7 @@
         if ($lesson->usepassword && !isteacher($course->id)) {
             $correctpass = false;
             if (isset($_POST['userpassword'])) {
-                if ($lesson->password == md5(trim($_POST['userpassword']))) {
+                if ($lesson->password == md5(trim(clean_param($_POST['userpassword'], PARAM_CLEAN)))) {
                     $USER->lessonloggedin[$lesson->id] = true;
                     $correctpass = true;
                 }
@@ -588,6 +588,7 @@
                 echo "<input type=\"hidden\" name=\"id\" value=\"$cm->id\" />";
                 echo "<input type=\"hidden\" name=\"action\" value=\"continue\" />";
                 echo "<input type=\"hidden\" name=\"pageid\" value=\"$pageid\" />";
+                               echo "<input type=\"hidden\" name=\"sesskey\" value=\"".$USER->sesskey."\" />";
                 /// CDC-FLAG ///
                 if (!$lesson->slideshow || $page->qtype != 20) {
                     print_simple_box_start("center");
@@ -1249,13 +1250,14 @@
                 echo "</div>";
             } else {
                 if(isset($_GET['display']) && !isset($_GET['viewAll'])) {
+                                       $display = clean_param($_GET['display'], PARAM_INT);
                     while(true)
                     {
-                        if($page->id == $_GET['display'] && $page->qtype == LESSON_BRANCHTABLE) {
+                        if($page->id == $display && $page->qtype == LESSON_BRANCHTABLE) {
                             $branch = true;
                             $singlePage = false;
                             break;
-                        } elseif($page->id == $_GET['display']) {
+                        } elseif($page->id == $display) {
                             $branch = false;
                             $singlePage = true;        
                             break;
@@ -1267,17 +1269,17 @@
                             // last page reached
                             break;
                         }
-                     }
+                    }
                     echo "<center><a href=\"view.php?id=$id&amp;viewAll=1\">".get_string("viewallpages", "lesson")."</a><br />\n";
                     echo "<a href=\"view.php?id=$id\">".get_string("backtreeview", "lesson")."</a><br />\n";
                     echo "<table cellpadding=\"5\" border=\"0\" width=\"80%\">\n";
                     if (isteacheredit($course->id)) {
                         /// CDC-FLAG 6/16/04 ///                                       
-                        echo "<tr><td align=\"right\"><small><a href=\"import.php?id=$cm->id&amp;pageid=$page->prevpageid\">".
+                        echo "<tr><td align=\"left\"><small><a href=\"import.php?id=$cm->id&amp;pageid=$page->prevpageid\">".
                             get_string("importquestions", "lesson")."</a> | ".
-                            "<a href=\"lesson.php?id=$cm->id&amp;action=addcluster&amp;pageid=$page->prevpageid\">".
+                            "<a href=\"lesson.php?id=$cm->id&amp;sesskey=".$USER->sesskey."&amp;action=addcluster&amp;pageid=$page->prevpageid\">".
                             get_string("addcluster", "lesson")."</a> | ".
-                            "<a href=\"lesson.php?id=$cm->id&amp;action=addendofcluster&amp;pageid=$page->prevpageid\">".
+                            "<a href=\"lesson.php?id=$cm->id&amp;sesskey=".$USER->sesskey."&amp;action=addendofcluster&amp;pageid=$page->prevpageid\">".
                             get_string("addendofcluster", "lesson")."</a> | ".
                             "<a href=\"lesson.php?id=$cm->id&amp;action=addbranchtable&amp;pageid=$page->prevpageid\">".
                             get_string("addabranchtable", "lesson")."</a> | ".
@@ -1290,12 +1292,12 @@
                     if($lesson->tree) {
                         echo "<center><a href=\"view.php?id=$id\">".get_string("backtreeview", "lesson")."</a><br /></center>\n";
                     }  
-                    echo "<center><table cellpadding=\"5\" border=\"0\" width=\"80%\">\n";
+                    echo "<table align=\"center\" cellpadding=\"5\" border=\"0\" width=\"80%\">\n";
                     if (isteacheredit($course->id)) {
                         /// CDC-FLAG 6/16/04 ///
                         echo "<tr><td align=\"left\"><small><a href=\"import.php?id=$cm->id&amp;pageid=0\">".
                             get_string("importquestions", "lesson")."</a> | ".
-                            "<a href=\"lesson.php?id=$cm->id&amp;action=addcluster&amp;pageid=0\">".
+                            "<a href=\"lesson.php?id=$cm->id&amp;sesskey=".$USER->sesskey."&amp;action=addcluster&amp;pageid=0\">".
                             get_string("addcluster", "lesson")."</a> | ".
                             "<a href=\"lesson.php?id=$cm->id&amp;action=addbranchtable&amp;pageid=0\">".
                             get_string("addabranchtable", "lesson")."</a> | ".
@@ -1306,8 +1308,8 @@
                     }
                 }
                 /// CDC-FLAG /// end tree code (note, there is an "}" below for an else above)
-            echo "<tr><td>\n";
             while (true) {
+               echo "<tr><td>\n";
                 echo "<table width=\"100%\" border=\"1\"><tr><td bgcolor=\"$THEME->cellheading2\" colspan=\"2\"><b>$page->title</b>&nbsp;&nbsp;\n";
                 if (isteacheredit($course->id)) {
                     if ($npages > 1) {
@@ -1316,7 +1318,7 @@
                     }
                     echo "<a title=\"".get_string("update")."\" href=\"lesson.php?id=$cm->id&amp;action=editpage&amp;pageid=$page->id\">\n".
                         "<img src=\"$pixpath/t/edit.gif\" hspace=\"2\" height=\"11\" width=\"11\" border=\"0\" alt=\"edit\" /></a>\n".
-                        "<a title=\"".get_string("delete")."\" href=\"lesson.php?id=$cm->id&amp;action=confirmdelete&amp;pageid=$page->id\">\n".
+                        "<a title=\"".get_string("delete")."\" href=\"lesson.php?id=$cm->id&amp;sesskey=".$USER->sesskey."&amp;action=confirmdelete&amp;pageid=$page->id\">\n".
                         "<img src=\"$pixpath/t/delete.gif\" hspace=\"2\" height=\"11\" width=\"11\" border=\"0\" alt=\"delete\" /></a>\n";
                 }
                 echo "</td></tr>\n";             
@@ -1387,7 +1389,7 @@
                                 echo "</td><td width=\"80%\">\n";
                                 echo format_text($answer->answer);
                                 echo "</td></tr>\n";
-                               echo "<tr><td align=\"right\" valign=\"top\"><b>".get_string("response", "lesson")." $i:</b> \n";
+                                echo "<tr><td align=\"right\" valign=\"top\"><b>".get_string("response", "lesson")." $i:</b> \n";
                                 echo "</td><td>\n";
                                 echo format_text($answer->response); 
                                 echo "</td></tr>\n";
@@ -1512,9 +1514,9 @@
                     /// CDC-FLAG /// 6/16/04                           
                     echo "<tr><td align=\"left\"><small><a href=\"import.php?id=$cm->id&amp;pageid=$page->id\">".
                         get_string("importquestions", "lesson")."</a> | ".    
-                         "<a href=\"lesson.php?id=$cm->id&amp;action=addcluster&amp;pageid=$page->id\">".
+                         "<a href=\"lesson.php?id=$cm->id&amp;sesskey=".$USER->sesskey."&amp;action=addcluster&amp;pageid=$page->id\">".
                          get_string("addcluster", "lesson")."</a> | ".
-                         "<a href=\"lesson.php?id=$cm->id&amp;action=addendofcluster&amp;pageid=$page->id\">".
+                         "<a href=\"lesson.php?id=$cm->id&amp;sesskey=".$USER->sesskey."&amp;action=addendofcluster&amp;pageid=$page->id\">".
                          get_string("addendofcluster", "lesson")."</a> | ".
                          "<a href=\"lesson.php?id=$cm->id&amp;action=addbranchtable&amp;pageid=$page->id\">".
                         get_string("addabranchtable", "lesson")."</a><br />";
@@ -1525,7 +1527,7 @@
                         $nextqtype = get_field("lesson_pages", "qtype", "id", $page->nextpageid);
                     }
                     if (($page->qtype != LESSON_ENDOFBRANCH) and ($nextqtype != LESSON_ENDOFBRANCH)) {
-                        echo "<a href=\"lesson.php?id=$cm->id&amp;action=addendofbranch&amp;pageid=$page->id\">".
+                        echo "<a href=\"lesson.php?id=$cm->id&amp;sesskey=".$USER->sesskey."&amp;action=addendofbranch&amp;pageid=$page->id\">".
                         get_string("addanendofbranch", "lesson")."</a> | ";
                     }
                     echo "<a href=\"lesson.php?id=$cm->id&amp;action=addpage&amp;pageid=$page->id\">".
@@ -1648,12 +1650,12 @@
                                }
             }
                        // email link for this user
-                       $emaillink = "<a href=\"view.php?id=$cm->id&amp;action=emailessay&userid=".$id."\">".get_string("emailgradedessays", "lesson")."</a>";
+                       $emaillink = "<a href=\"view.php?id=$cm->id&amp;action=emailessay&amp;userid=".$id."&amp;sesskey=".$USER->sesskey."\">".get_string("emailgradedessays", "lesson")."</a>";
 
                        $table->data[] = array($studentname, implode(", ", $essaylinks), $emaillink);        
                }
                // email link for all users
-               $emailalllink = "<a href=\"view.php?id=$cm->id&amp;action=emailessay\">".get_string("emailallgradedessays", "lesson")."</a>";
+               $emailalllink = "<a href=\"view.php?id=$cm->id&amp;action=emailessay&amp;sesskey=".$USER->sesskey."\">".get_string("emailallgradedessays", "lesson")."</a>";
         
                $table->data[] = array(" ", " ", $emailalllink);
                
@@ -1664,7 +1666,7 @@
     elseif ($action == 'essaygrade') {
         print_heading_with_help($lesson->name, "overview", "lesson");
                
-               require_variable($attemptid);
+               $attemptid = require_variable('attemptid');
 
         if (!$essay = get_record("lesson_attempts", "id", $attemptid)) {
             error("Error: could not find essay");
@@ -1684,6 +1686,7 @@
         echo "<input type=\"hidden\" name=\"id\" value=\"$cm->id\" />\n";
         echo "<input type=\"hidden\" name=\"action\" />\n";
         echo "<input type=\"hidden\" name=\"attemptid\" value=\"$attemptid\" />\n";
+        echo "<input type=\"hidden\" name=\"sesskey\" value=\"".$USER->sesskey."\" />\n";              
        
                // all tables will have these
         $table->align = array("left");
@@ -1739,7 +1742,9 @@
     elseif ($action == 'updategrade') {
         print_heading_with_help($lesson->name, "overview", "lesson");
         
-        $form = data_submitted();
+               confirm_sesskey();
+               
+        $form = lesson_clean_data_submitted();
         
         if (!$essay = get_record("lesson_attempts", "id", $form->attemptid)) {
             error("Error: could not find essay");
@@ -1781,9 +1786,12 @@
     elseif ($action == 'emailessay') {
         print_heading_with_help($lesson->name, "overview", "lesson");
    
-        if (isset($_GET['userid'])) {          
-            $queryadd = " AND userid = ".$_GET['userid'];
-                       if (! $users = get_records("user", "id", $_GET['userid'])) {
+               confirm_sesskey();
+       
+        if (isset($_GET['userid'])) {
+                       $userid = clean_param($_GET['userid'], PARAM_INT);              
+            $queryadd = " AND userid = ".$userid;
+                       if (! $users = get_records("user", "id", $userid)) {
                error("Error: could not find users");
                        }
         } else {
@@ -1905,6 +1913,8 @@
     /*******************update high scores **************************************/
     elseif ($action == 'updatehighscores') {
         print_heading_with_help($lesson->name, "overview", "lesson");
+       
+               confirm_sesskey();
 
         if (!$grades = get_records_select("lesson_grades", "lessonid = $lesson->id", "completed")) {
             error("Error: could not find grades");
@@ -1969,7 +1979,7 @@
         $newhighscore->userid = $USER->id;
         $newhighscore->gradeid = $newgrade->id;
         if (isset($_GET['name'])) {
-            $newhighscore->nickname = $_GET['name'];
+            $newhighscore->nickname = clean_param($_GET['name'], PARAM_CLEAN);
         }
         if (!insert_record("lesson_high_scores", $newhighscore)) {
             error("Insert of new high score Failed!");
@@ -1983,8 +1993,9 @@
         print_heading_with_help($lesson->name, "overview", "lesson");
         echo "<div align=\"center\">";
         if (isset($_POST['name'])) {
-            if (lesson_check_nickname(trim($_POST['name']))) {
-                redirect("view.php?id=$cm->id&amp;action=updatehighscores&amp;name=".trim($_POST['name']), get_string("nameapproved", "lesson"));
+                       $name = trim(param_clean($_POST['name'], PARAM_CLEAN));
+            if (lesson_check_nickname($name)) {
+                redirect("view.php?id=$cm->id&amp;action=updatehighscores&amp;name=$name&amp;sesskey=".$USER->sesskey, get_string("nameapproved", "lesson"));
             } else {
                 echo get_string("namereject", "lesson")."<br><br>";
             }