mirror_php/moodle
1
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-04-21 16:32:18 +02:00
Code Issues Projects Releases Wiki Activity

MDL-81267 mod_data: Clean field type before inclusion

Browse Source 
* Filter out wrong field types when restoring or creating a field.
This commit is contained in:
Laurent David 2024-03-21 12:22:13 +01:00 committed by Sara Arjona
parent e4406472f0
commit 9d5a4746ab
No known key found for this signature in database
3 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
mod/data/backup/moodle2/restore_data_stepslib.php
View File

@ -87,6 +87,7 @@ class restore_data_activity_structure_step extends restore_activity_structure_st
$oldid = $data->id;
$data->dataid = $this->get_new_parentid('data');
$data->type = clean_param($data->type, PARAM_ALPHA);
// insert the data_fields record
$newitemid = $DB->insert_record('data_fields', $data);

2
mod/data/lib.php
View File

@ -951,6 +951,7 @@ function data_get_field_from_id($fieldid, $data){
function data_get_field_new($type, $data) {
global $CFG;
$type = clean_param($type, PARAM_ALPHA);
$filepath = $CFG->dirroot.'/mod/data/field/'.$type.'/field.class.php';
// It should never access this method if the subfield class doesn't exist.
if (!file_exists($filepath)) {
@ -978,6 +979,7 @@ function data_get_field($field, $data, $cm=null) {
if (!isset($field->type)) {
return new data_field_base($field);
}
$field->type = clean_param($field->type, PARAM_ALPHA);
$filepath = $CFG->dirroot.'/mod/data/field/'.$field->type.'/field.class.php';
if (!file_exists($filepath)) {
return new data_field_base($field);

2
mod/data/locallib.php
View File

@ -983,6 +983,7 @@ function data_get_tag_title_field($dataid) {
if ($field->addtemplateposition === false) {
continue;
}
$field->type = clean_param($field->type, PARAM_ALPHA);
$filepath = $CFG->dirroot . '/mod/data/field/' . $field->type . '/field.class.php';
if (!file_exists($filepath)) {
continue;
@ -1026,6 +1027,7 @@ function data_get_tag_title_for_entry($field, $entry) {
if (!isset($field->type)) {
return null;
}
$field->type = clean_param($field->type, PARAM_ALPHA);
$filepath = $CFG->dirroot . '/mod/data/field/' . $field->type . '/field.class.php';
if (!file_exists($filepath)) {
return null;