From b0b228f7b9f049044161de6547a9dffc1185cac5 Mon Sep 17 00:00:00 2001 From: Ciaran Irvine Date: Wed, 28 Mar 2012 13:43:18 +0800 Subject: [PATCH] MDL-31746 calendar: insufficient parameter cleaning --- calendar/event.php | 104 +++++++++++++++++++++++++++------------------ 1 file changed, 62 insertions(+), 42 deletions(-) diff --git a/calendar/event.php b/calendar/event.php index 5325aa4a276..f191bb52047 100644 --- a/calendar/event.php +++ b/calendar/event.php @@ -103,6 +103,7 @@ } $form = null; + $err = array(); switch($action) { case 'delete': @@ -129,23 +130,7 @@ } if($form = data_submitted() and confirm_sesskey()) { - - $form->name = clean_param(strip_tags($form->name,''), PARAM_CLEAN); - - $form->timestart = make_timestamp($form->startyr, $form->startmon, $form->startday, $form->starthr, $form->startmin); - if($form->duration == 1) { - $form->timeduration = make_timestamp($form->endyr, $form->endmon, $form->endday, $form->endhr, $form->endmin) - $form->timestart; - if($form->timeduration < 0) { - $form->timeduration = 0; - } - } - else if($form->duration == 2) { - $form->timeduration = $form->minutes * MINSECS; - } - else { - $form->timeduration = 0; - } - + // validate form and set error if any. validate_form($form, $err); if (count($err) == 0) { @@ -194,26 +179,13 @@ $title = get_string('newevent', 'calendar'); $form = data_submitted(); if(!empty($form) && !empty($form->name) && confirm_sesskey()) { + // validate form and set error if any. + validate_form($form, $err); - $form->name = clean_text(strip_tags($form->name, '')); - - $form->timestart = make_timestamp($form->startyr, $form->startmon, $form->startday, $form->starthr, $form->startmin); - if($form->duration == 1) { - $form->timeduration = make_timestamp($form->endyr, $form->endmon, $form->endday, $form->endhr, $form->endmin) - $form->timestart; - if($form->timeduration < 0) { - $form->timeduration = 0; - } - } - else if ($form->duration == 2) { - $form->timeduration = $form->minutes * MINSECS; - } - else { - $form->timeduration = 0; - } if(!calendar_add_event_allowed($form)) { error('You are not authorized to do this'); } - validate_form($form, $err); + if (count($err) == 0) { $form->timemodified = time(); @@ -568,11 +540,36 @@ function validate_form(&$form, &$err) { - + //first clean the form values + $form->name = clean_param(strip_tags($form->name, ''),PARAM_CLEAN); $form->name = trim($form->name); - $form->description = trim($form->description); - - if(empty($form->name)) { + $form->description = addslashes(clean_param($form->description, PARAM_CLEANHTML)); + $form->duration = clean_param($form->duration, PARAM_INT); + $form->startmon = clean_param($form->startmon, PARAM_INT); + $form->startday = clean_param($form->startday, PARAM_INT); + $form->startyr = clean_param($form->startyr, PARAM_INT); + $form->starthr = clean_param($form->starthr, PARAM_INT); + $form->startmin = clean_param($form->startmin, PARAM_INT); + $form->endmon = clean_param($form->endmon, PARAM_INT); + $form->endday = clean_param($form->endday, PARAM_INT); + $form->endyr = clean_param($form->endyr, PARAM_INT); + $form->endhr = clean_param($form->endhr, PARAM_INT); + $form->endmin = clean_param($form->endmin, PARAM_INT); + $form->minutes = clean_param($form->minutes, PARAM_INT); + $form->repeat = clean_param($form->repeat, PARAM_INT); + $form->repeats = clean_param($form->repeats, PARAM_INT); + $form->courseid = clean_param($form->courseid, PARAM_INT); + $form->groupid = clean_param($form->groupid, PARAM_INT); + $form->userid = clean_param($form->userid, PARAM_INT); + $form->modulename = clean_param($form->modulename, PARAM_SAFEDIR); + $form->eventtype = clean_param($form->eventtype, PARAM_ALPHA); + $form->instance = clean_param($form->instance, PARAM_INT); + $form->format = clean_param($form->format, PARAM_INT); + $form->action = clean_param($form->action, PARAM_ALPHA); + $form->type = clean_param($form->type, PARAM_ALPHA); + $form->course = clean_param($form->course, PARAM_INT); + + if (empty($form->name)) { $err['name'] = get_string('errornoeventname', 'calendar'); } /* Allow events without a description @@ -580,28 +577,51 @@ function validate_form(&$form, &$err) { $err['description'] = get_string('errornodescription', 'calendar'); } */ - if(!checkdate($form->startmon, $form->startday, $form->startyr)) { + if (!checkdate($form->startmon, $form->startday, $form->startyr)) { $err['timestart'] = get_string('errorinvaliddate', 'calendar'); } - if($form->duration == 2 and !checkdate($form->endmon, $form->endday, $form->endyr)) { + if ($form->duration == 2 and !checkdate($form->endmon, $form->endday, $form->endyr)) { $err['timeduration'] = get_string('errorinvaliddate', 'calendar'); } - if($form->duration == 2 and !($form->minutes > 0 and $form->minutes < 1000)) { + if ($form->duration == 2 and !($form->minutes > 0 and $form->minutes < 1000)) { $err['minutes'] = get_string('errorinvalidminutes', 'calendar'); } if (!empty($form->repeat) and !($form->repeats > 1 and $form->repeats < 100)) { $err['repeats'] = get_string('errorinvalidrepeats', 'calendar'); } - if(!empty($form->courseid)) { + + // set start time and duration + $form->timestart = make_timestamp($form->startyr, $form->startmon, $form->startday, $form->starthr, $form->startmin); + if ($form->duration == 1) { + $form->timeduration = make_timestamp($form->endyr, $form->endmon, $form->endday, $form->endhr, $form->endmin) - $form->timestart; + if ($form->timeduration < 0) { + $form->timeduration = 0; + } + } + else if ($form->duration == 2) { + $form->timeduration = $form->minutes * MINSECS; + } + else { + $form->timeduration = 0; + } + + if (!empty($form->courseid)) { // Timestamps must be >= course startdate $course = get_record('course', 'id', $form->courseid); - if($course === false) { + if ($course === false) { error('Event belongs to invalid course'); } else if($form->timestart < $course->startdate) { $err['timestart'] = get_string('errorbeforecoursestart', 'calendar'); } } + if (!empty($form->modulename)) { + // Check that passed modulename actually exists (possible SQL Injection route) + $module = get_record('modules', 'name', $form->modulename); + if ($module === false) { + error('Invalid module name'); + } + } } function calendar_add_event_allowed($event) { -- 2.43.0