not supported */ define('PARAM_TAG', 0x0011); /** * PARAM_TAGLIST - list of tags separated by commas (interests, blogs, etc.) */ define('PARAM_TAGLIST', 0x0012); /** * PARAM_PATH - safe relative path name, all dangerous chars are stripped, protects against XSS, SQL injections and directory traversals * note: the leading slash is not removed, window drive letter is not allowed */ define('PARAM_PATH', 0x0020); /** * PARAM_HOST - expected fully qualified domain name (FQDN) or an IPv4 dotted quad (IP address) */ define('PARAM_HOST', 0x0040); /** * PARAM_URL - expected properly formatted URL. Please note that domain part is required, http://localhost/ is not acceppted but http://localhost.localdomain/ is ok. */ define('PARAM_URL', 0x0080); /** * PARAM_LOCALURL - expected properly formatted URL as well as one that refers to the local server itself. (NOT orthogonal to the others! Implies PARAM_URL!) */ define('PARAM_LOCALURL', 0x0180); /** * PARAM_BOOL - converts input into 0 or 1, use for switches in forms and urls. */ define('PARAM_BOOL', 0x0800); /** * PARAM_CLEANHTML - cleans submitted HTML code and removes slashes */ define('PARAM_CLEANHTML',0x1000); /** * PARAM_SAFEDIR - safe directory name, suitable for include() and require() */ define('PARAM_SAFEDIR', 0x4000); /** * PARAM_SAFEPATH - several PARAM_SAFEDIR joined by "/", suitable for include() and require(), plugin paths, etc. */ define('PARAM_SAFEPATH', 0x4001); /** * PARAM_SEQUENCE - expects a sequence of numbers like 8 to 1,5,6,4,6,8,9. Numbers and comma only. */ define('PARAM_SEQUENCE', 0x8000); /** * PARAM_PEM - Privacy Enhanced Mail format */ define('PARAM_PEM', 0x10000); /** * PARAM_BASE64 - Base 64 encoded format */ define('PARAM_BASE64', 0x20000); /** * PARAM_CAPABILITY - A capability name, like 'moodle/role:manage'. Actually * checked against the list of capabilties in the database. */ define('PARAM_CAPABILITY', 0x40000); /** * PARAM_PERMISSION - A permission, one of CAP_INHERIT, CAP_ALLOW, CAP_PREVENT or CAP_PROHIBIT. */ define('PARAM_PERMISSION', 0x80000); /// Page types /// /** * PAGE_COURSE_VIEW is a definition of a page type. For more information on the page class see moodle/lib/pagelib.php. */ define('PAGE_COURSE_VIEW', 'course-view'); /// Debug levels /// /** no warnings at all */ define ('DEBUG_NONE', 0); /** E_ERROR | E_PARSE */ define ('DEBUG_MINIMAL', 5); /** E_ERROR | E_PARSE | E_WARNING | E_NOTICE */ define ('DEBUG_NORMAL', 15); /** E_ALL without E_STRICT for now, do show recoverable fatal errors */ define ('DEBUG_ALL', 6143); /** DEBUG_ALL with extra Moodle debug messages - (DEBUG_ALL | 32768) */ define ('DEBUG_DEVELOPER', 38911); /** Get remote addr constant */ define('GETREMOTEADDR_SKIP_HTTP_CLIENT_IP', '1'); /** Get remote addr constant */ define('GETREMOTEADDR_SKIP_HTTP_X_FORWARDED_FOR', '2'); /// Blog access level constant declaration /// define ('BLOG_USER_LEVEL', 1); define ('BLOG_GROUP_LEVEL', 2); define ('BLOG_COURSE_LEVEL', 3); define ('BLOG_SITE_LEVEL', 4); define ('BLOG_GLOBAL_LEVEL', 5); ///Tag constants/// /** * To prevent problems with multibytes strings,Flag updating in nav not working on the review page. this should not exceed the * length of "varchar(255) / 3 (bytes / utf-8 character) = 85". * TODO: this is not correct, varchar(255) are 255 unicode chars ;-) */ define('TAG_MAX_LENGTH', 50); /// Password policy constants /// define ('PASSWORD_LOWER', 'abcdefghijklmnopqrstuvwxyz'); define ('PASSWORD_UPPER', 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'); define ('PASSWORD_DIGITS', '0123456789'); define ('PASSWORD_NONALPHANUM', '.,;:!?_-+/*@#&$'); /// Feature constants /// // Used for plugin_supports() to report features that are, or are not, supported by a module. /** True if module can provide a grade */ define('FEATURE_GRADE_HAS_GRADE', 'grade_has_grade'); /** True if module has code to track whether somebody viewed it */ define('FEATURE_COMPLETION_TRACKS_VIEWS', 'completion_tracks_views'); /** True if module has custom completion rules */ define('FEATURE_COMPLETION_HAS_RULES', 'completion_has_rules'); /// PARAMETER HANDLING //////////////////////////////////////////////////// /** * Returns a particular value for the named variable, taken from * POST or GET. If the parameter doesn't exist then an error is * thrown because we require this variable. * * This function should be used to initialise all required values * in a script that are based on parameters. Usually it will be * used like this: * $id = required_param('id'); * * @param string $parname the name of the page parameter we want * @param int $type expected type of parameter * @return mixed */ function required_param($parname, $type=PARAM_CLEAN) { if (isset($_POST[$parname])) { // POST has precedence $param = $_POST[$parname]; } else if (isset($_GET[$parname])) { $param = $_GET[$parname]; } else { print_error('missingparam', '', '', $parname); } return clean_param($param, $type); } /** * Returns a particular value for the named variable, taken from * POST or GET, otherwise returning a given default. * * This function should be used to initialise all optional values * in a script that are based on parameters. Usually it will be * used like this: * $name = optional_param('name', 'Fred'); * * @param string $parname the name of the page parameter we want * @param mixed $default the default value to return if nothing is found * @param int $type expected type of parameter * @return mixed */ function optional_param($parname, $default=NULL, $type=PARAM_CLEAN) { if (isset($_POST[$parname])) { // POST has precedence $param = $_POST[$parname]; } else if (isset($_GET[$parname])) { $param = $_GET[$parname]; } else { return $default; } return clean_param($param, $type); } /** * Used by {@link optional_param()} and {@link required_param()} to * clean the variables and/or cast to specific types, based on * an options field. * * $course->format = clean_param($course->format, PARAM_ALPHA); * $selectedgrade_item = clean_param($selectedgrade_item, PARAM_CLEAN); * * * @uses $CFG * @uses PARAM_RAW * @uses PARAM_CLEAN * @uses PARAM_CLEANHTML * @uses PARAM_INT * @uses PARAM_FLOAT * @uses PARAM_NUMBER * @uses PARAM_ALPHA * @uses PARAM_ALPHAEXT * @uses PARAM_ALPHANUM * @uses PARAM_ALPHANUMEXT * @uses PARAM_SEQUENCE * @uses PARAM_BOOL * @uses PARAM_NOTAGS * @uses PARAM_TEXT * @uses PARAM_SAFEDIR * @uses PARAM_SAFEPATH * @uses PARAM_FILE * @uses PARAM_PATH * @uses PARAM_HOST * @uses PARAM_URL * @uses PARAM_LOCALURL * @uses PARAM_PEM * @uses PARAM_BASE64 * @uses PARAM_TAG * @uses PARAM_SEQUENCE * @param mixed $param the variable we are cleaning * @param int $type expected format of param after cleaning. * @return mixed */ function clean_param($param, $type) { global $CFG; if (is_array($param)) { // Let's loop $newparam = array(); foreach ($param as $key => $value) { $newparam[$key] = clean_param($value, $type); } return $newparam; } switch ($type) { case PARAM_RAW: // no cleaning at all return $param; case PARAM_CLEAN: // General HTML cleaning, try to use more specific type if possible if (is_numeric($param)) { return $param; } return clean_text($param); // Sweep for scripts, etc case PARAM_CLEANHTML: // prepare html fragment for display, do not store it into db!! $param = clean_text($param); // Sweep for scripts, etc return trim($param); case PARAM_INT: return (int)$param; // Convert to integer case PARAM_FLOAT: case PARAM_NUMBER: return (float)$param; // Convert to float case PARAM_ALPHA: // Remove everything not a-z return eregi_replace('[^a-zA-Z]', '', $param); case PARAM_ALPHAEXT: // Remove everything not a-zA-Z_- (originally allowed "/" too) return eregi_replace('[^a-zA-Z_-]', '', $param); case PARAM_ALPHANUM: // Remove everything not a-zA-Z0-9 return eregi_replace('[^A-Za-z0-9]', '', $param); case PARAM_ALPHANUMEXT: // Remove everything not a-zA-Z0-9_- return eregi_replace('[^A-Za-z0-9_-]', '', $param); case PARAM_SEQUENCE: // Remove everything not 0-9, return eregi_replace('[^0-9,]', '', $param); case PARAM_BOOL: // Convert to 1 or 0 $tempstr = strtolower($param); if ($tempstr === 'on' or $tempstr === 'yes' or $tempstr === 'true') { $param = 1; } else if ($tempstr === 'off' or $tempstr === 'no' or $tempstr === 'false') { $param = 0; } else { $param = empty($param) ? 0 : 1; } return $param; case PARAM_NOTAGS: // Strip all tags return strip_tags($param); case PARAM_TEXT: // leave only tags needed for multilang return clean_param(strip_tags($param, ''), PARAM_CLEAN); case PARAM_SAFEDIR: // Remove everything not a-zA-Z0-9_- return eregi_replace('[^a-zA-Z0-9_-]', '', $param); case PARAM_SAFEPATH: // Remove everything not a-zA-Z0-9/_- return eregi_replace('[^a-zA-Z0-9/_-]', '', $param); case PARAM_FILE: // Strip all suspicious characters from filename $param = ereg_replace('[[:cntrl:]]|[&<>"`\|\':\\/]', '', $param); $param = ereg_replace('\.\.+', '', $param); if ($param === '.') { $param = ''; } return $param; case PARAM_PATH: // Strip all suspicious characters from file path $param = str_replace('\\', '/', $param); $param = ereg_replace('[[:cntrl:]]|[&<>"`\|\':]', '', $param); $param = ereg_replace('\.\.+', '', $param); $param = ereg_replace('//+', '/', $param); return ereg_replace('/(\./)+', '/', $param); case PARAM_HOST: // allow FQDN or IPv4 dotted quad $param = preg_replace('/[^\.\d\w-]/','', $param ); // only allowed chars // match ipv4 dotted quad if (preg_match('/(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/',$param, $match)){ // confirm values are ok if ( $match[0] > 255 || $match[1] > 255 || $match[3] > 255 || $match[4] > 255 ) { // hmmm, what kind of dotted quad is this? $param = ''; } } elseif ( preg_match('/^[\w\d\.-]+$/', $param) // dots, hyphens, numbers && !preg_match('/^[\.-]/', $param) // no leading dots/hyphens && !preg_match('/[\.-]$/', $param) // no trailing dots/hyphens ) { // all is ok - $param is respected } else { // all is not ok... $param=''; } return $param; case PARAM_URL: // allow safe ftp, http, mailto urls include_once($CFG->dirroot . '/lib/validateurlsyntax.php'); if (!empty($param) && validateUrlSyntax($param, 's?H?S?F?E?u-P-a?I?p?f?q?r?')) { // all is ok, param is respected } else { $param =''; // not really ok } return $param; case PARAM_LOCALURL: // allow http absolute, root relative and relative URLs within wwwroot $param = clean_param($param, PARAM_URL); if (!empty($param)) { if (preg_match(':^/:', $param)) { // root-relative, ok! } elseif (preg_match('/^'.preg_quote($CFG->wwwroot, '/').'/i',$param)) { // absolute, and matches our wwwroot } else { // relative - let's make sure there are no tricks if (validateUrlSyntax($param, 's-u-P-a-p-f+q?r?')) { // looks ok. } else { $param = ''; } } } return $param; case PARAM_PEM: $param = trim($param); // PEM formatted strings may contain letters/numbers and the symbols // forward slash: / // plus sign: + // equal sign: = // , surrounded by BEGIN and END CERTIFICATE prefix and suffixes if (preg_match('/^-----BEGIN CERTIFICATE-----([\s\w\/\+=]+)-----END CERTIFICATE-----$/', trim($param), $matches)) { list($wholething, $body) = $matches; unset($wholething, $matches); $b64 = clean_param($body, PARAM_BASE64); if (!empty($b64)) { return "-----BEGIN CERTIFICATE-----\n$b64\n-----END CERTIFICATE-----\n"; } else { return ''; } } return ''; case PARAM_BASE64: if (!empty($param)) { // PEM formatted strings may contain letters/numbers and the symbols // forward slash: / // plus sign: + // equal sign: = if (0 >= preg_match('/^([\s\w\/\+=]+)$/', trim($param))) { return ''; } $lines = preg_split('/[\s]+/', $param, -1, PREG_SPLIT_NO_EMPTY); // Each line of base64 encoded data must be 64 characters in // length, except for the last line which may be less than (or // equal to) 64 characters long. for ($i=0, $j=count($lines); $i < $j; $i++) { if ($i + 1 == $j) { if (64 < strlen($lines[$i])) { return ''; } continue; } if (64 != strlen($lines[$i])) { return ''; } } return implode("\n",$lines); } else { return ''; } case PARAM_TAG: //as long as magic_quotes_gpc is used, a backslash will be a //problem, so remove *all* backslash. //$param = str_replace('\\', '', $param); //remove some nasties $param = ereg_replace('[[:cntrl:]]|[<>`]', '', $param); //convert many whitespace chars into one $param = preg_replace('/\s+/', ' ', $param); $textlib = textlib_get_instance(); $param = $textlib->substr(trim($param), 0, TAG_MAX_LENGTH); return $param; case PARAM_TAGLIST: $tags = explode(',', $param); $result = array(); foreach ($tags as $tag) { $res = clean_param($tag, PARAM_TAG); if ($res !== '') { $result[] = $res; } } if ($result) { return implode(',', $result); } else { return ''; } case PARAM_CAPABILITY: if (is_valid_capability($param)) { return $param; } else { return ''; } case PARAM_PERMISSION: $param = (int)$param; if (in_array($param, array(CAP_INHERIT, CAP_ALLOW, CAP_PREVENT, CAP_PROHIBIT))) { return $param; } else { return CAP_INHERIT; } default: // throw error, switched parameters in optional_param or another serious problem print_error("unknowparamtype", '', '', $type); } } /** * Return true if given value is integer or string with integer value */ function is_number($value) { if (is_int($value)) { return true; } else if (is_string($value)) { return ((string)(int)$value) === $value; } else { return false; } } /** * This function is useful for testing whether something you got back from * the HTML editor actually contains anything. Sometimes the HTML editor * appear to be empty, but actually you get back a
tag or something. * * @param string $string a string containing HTML. * @return boolean does the string contain any actual content - that is text, * images, objcts, etc. */ function html_is_blank($string) { return trim(strip_tags($string, '