mirror_php/moodle
1
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-01-31 04:33:13 +01:00
Code Issues Projects Releases Wiki Activity

"MDL-19118, fixed security bug in comments, thanks to Petr"

Browse Source
This commit is contained in:
Dongsheng Cai 2010-03-16 07:57:45 +00:00
parent 158cd5d91a
commit 5758852313
2 changed files with 6 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
comment/comment_ajax.php
View File

@ -21,16 +21,10 @@
require_once('../config.php');
require_once($CFG->dirroot . '/comment/lib.php');
$courseid = optional_param('courseid', SITEID, PARAM_INT);
$contextid = optional_param('contextid', SYSCONTEXTID, PARAM_INT);
list($context, $course, $cm) = get_context_info_array($contextid);
$context = get_context_instance_by_id($contextid);
if ($context->contextlevel == CONTEXT_MODULE) {
$cm = get_coursemodule_from_id('', $context->instanceid);
} else {
$cm = null;
}
require_login($courseid, true, $cm);
require_login($course->id, true, $cm);
$err = new stdclass;
@ -60,7 +54,7 @@ $page = optional_param('page', 0, PARAM_INT);
if (!empty($client_id)) {
$cmt = new stdclass;
$cmt->contextid = $contextid;
$cmt->courseid = $courseid;
$cmt->courseid = $course->id;
$cmt->area = $area;
$cmt->itemid = $itemid;
$cmt->client_id = $client_id;

6
comment/comment_post.php
View File

@ -21,8 +21,8 @@
require_once('../config.php');
require_once($CFG->dirroot . '/comment/lib.php');
$courseid = optional_param('courseid', SITEID, PARAM_INT);
$contextid = optional_param('contextid', SYSCONTEXTID, PARAM_INT);
list($context, $course, $cm) = get_context_info_array($contextid);
$context = get_context_instance_by_id($contextid);
if ($context->contextlevel == CONTEXT_MODULE) {
@ -30,7 +30,7 @@ if ($context->contextlevel == CONTEXT_MODULE) {
} else {
$cm = null;
}
require_login($courseid, true, $cm);
require_login($course->id, true, $cm);
$err = new stdclass;
@ -55,7 +55,7 @@ $returnurl = optional_param('returnurl', '', PARAM_URL);
$cmt = new stdclass;
$cmt->contextid = $contextid;
$cmt->courseid = $courseid;
$cmt->courseid = $course->id;
$cmt->area = $area;
$cmt->itemid = $itemid;
$comment = new comment($cmt);