From b6c93894fbb3b34ede90dcaa0e3a66a061cf65a3 Mon Sep 17 00:00:00 2001
From: martinlanghoff <martinlanghoff>
Date: Thu, 27 Jan 2005 03:51:33 +0000
Subject: [PATCH] Merged from MOODLE_14_STABLE - Stronger validation of form
data in user/edit, and validation of lang in current_language() -- closes
SC#67
---
lib/moodlelib.php | 8 ++++----
user/edit.php | 18 ++++++++++++++++--
2 files changed, 20 insertions(+), 6 deletions(-)
diff --git a/lib/moodlelib.php b/lib/moodlelib.php
index cbfa9e2668..969efd1ba8 100644
--- a/lib/moodlelib.php
+++ b/lib/moodlelib.php
@@ -3281,16 +3281,16 @@ function current_language() {
global $CFG, $USER, $SESSION;
if (!empty($CFG->courselang)) { // Course language can override all other settings for this page
- return $CFG->courselang;
+ return clean_param($CFG->courselang, PARAM_FILE);
} else if (!empty($SESSION->lang)) { // Session language can override other settings
- return $SESSION->lang;
+ return clean_param($SESSION->lang, PARAM_FILE);
} else if (!empty($USER->lang)) { // User language can override site language
- return $USER->lang;
+ return clean_param($USER->lang, PARAM_FILE);
} else {
- return $CFG->lang;
+ return clean_param($CFG->lang, PARAM_FILE);
}
}
diff --git a/user/edit.php b/user/edit.php
index a8b1dc94cf..2305f463a7 100644
--- a/user/edit.php
+++ b/user/edit.php
@@ -3,8 +3,8 @@
require_once("../config.php");
require_once("$CFG->libdir/gdlib.php");
- optional_variable($id); // user id
- optional_variable($course); // course id
+ $id = optional_param('id', PARAM_INT); // user id
+ $course = optional_param('course', PARAM_INT); // course id
if (empty($id)) { // See your own profile by default
require_login();
@@ -73,6 +73,20 @@
check_for_restricted_user($USER->username, "$CFG->wwwroot/course/view.php?id=$course->id");
}
+ // data cleanup
+ // username is validated in find_form_errors
+ $usernew->country = clean_param($usernew->country, PARAM_ALPHA);
+ $usernew->lang = clean_param($usernew->lang, PARAM_FILE);
+ $usernew->url = clean_param($usernew->url, PARAM_URL);
+ $usernew->icq = clean_param($usernew->icq, PARAM_INT);
+
+ $usernew->maildisplay = clean_param($usernew->maildisplay, PARAM_INT);
+ $usernew->mailformat = clean_param($usernew->mailformat, PARAM_INT);
+ $usernew->maildigest = clean_param($usernew->maildigest, PARAM_INT);
+ $usernew->autosubscribe = clean_param($usernew->autosubscribe, PARAM_INT);
+ $usernew->htmleditor = clean_param($usernew->htmleditor, PARAM_INT);
+ $usernew->emailstop = clean_param($usernew->emailstop, PARAM_INT);
+
foreach ($usernew as $key => $data) {
$usernew->$key = addslashes(clean_text(stripslashes($usernew->$key), FORMAT_MOODLE));
}
--
2.39.5