From f253646408016b200f52707c0230db7f78f93048 Mon Sep 17 00:00:00 2001
From: Ciaran Irvine <ciaran.irvine@totaralms.com>
Date: Mon, 26 Mar 2012 23:23:18 +0800
Subject: [PATCH] MDL-31746 calendar: insufficient parameter cleaning

---
 calendar/event.php | 55 +++++++++++++++++++++++++++++++++++++---------
 1 file changed, 45 insertions(+), 10 deletions(-)

diff --git a/calendar/event.php b/calendar/event.php
index 5325aa4a276..99d98b57479 100644
--- a/calendar/event.php
+++ b/calendar/event.php
@@ -103,6 +103,7 @@
     }
 
     $form = null;
+    $err = array();
 
     switch($action) {
         case 'delete':
@@ -129,8 +130,7 @@
             }
 
             if($form = data_submitted() and confirm_sesskey()) {
-
-                $form->name = clean_param(strip_tags($form->name,'<lang><span>'), PARAM_CLEAN);
+                validate_form($form, $err);
 
                 $form->timestart = make_timestamp($form->startyr, $form->startmon, $form->startday, $form->starthr, $form->startmin);
                 if($form->duration == 1) {
@@ -146,7 +146,8 @@
                     $form->timeduration = 0;
                 }
 
-                validate_form($form, $err);
+                // prepare description for insertion to DB
+                $form->description = addslashes($form->description);
 
                 if (count($err) == 0) {
 
@@ -194,9 +195,7 @@
             $title = get_string('newevent', 'calendar');
             $form = data_submitted();
             if(!empty($form) && !empty($form->name) && confirm_sesskey()) {
-
-                $form->name = clean_text(strip_tags($form->name, '<lang><span>'));
-
+                validate_form($form, $err);
                 $form->timestart = make_timestamp($form->startyr, $form->startmon, $form->startday, $form->starthr, $form->startmin);
                 if($form->duration == 1) {
                     $form->timeduration = make_timestamp($form->endyr, $form->endmon, $form->endday, $form->endhr, $form->endmin) - $form->timestart;
@@ -210,10 +209,14 @@
                 else {
                     $form->timeduration = 0;
                 }
+
+                // prepare description for insertion to DB
+                $form->description = addslashes($form->description);
+
                 if(!calendar_add_event_allowed($form)) {
                     error('You are not authorized to do this');
                 }
-                validate_form($form, $err);
+
                 if (count($err) == 0) {
                     $form->timemodified = time();
 
@@ -568,9 +571,34 @@
 
 
 function validate_form(&$form, &$err) {
-
+    //first clean the form values
+    $form->name = clean_param(strip_tags($form->name, '<lang><span>'),PARAM_CLEAN);
     $form->name = trim($form->name);
-    $form->description = trim($form->description);
+    $form->description = clean_param($form->description, PARAM_CLEANHTML);
+    $form->duration = clean_param($form->duration, PARAM_INT);
+    $form->startmon = clean_param($form->startmon, PARAM_INT);
+    $form->startday = clean_param($form->startday, PARAM_INT);
+    $form->startyr = clean_param($form->startyr, PARAM_INT);
+    $form->starthr = clean_param($form->starthr, PARAM_INT);
+    $form->startmin = clean_param($form->startmin, PARAM_INT);
+    $form->endmon = clean_param($form->endmon, PARAM_INT);
+    $form->endday = clean_param($form->endday, PARAM_INT);
+    $form->endyr = clean_param($form->endyr, PARAM_INT);
+    $form->endhr = clean_param($form->endhr, PARAM_INT);
+    $form->endmin = clean_param($form->endmin, PARAM_INT);
+    $form->minutes = clean_param($form->minutes, PARAM_INT);
+    $form->repeat = clean_param($form->repeat, PARAM_INT);
+    $form->repeats = clean_param($form->repeats, PARAM_INT);
+    $form->courseid = clean_param($form->courseid, PARAM_INT);
+    $form->groupid = clean_param($form->groupid, PARAM_INT);
+    $form->userid = clean_param($form->userid, PARAM_INT);
+    $form->modulename = clean_param($form->modulename, PARAM_SAFEDIR);
+    $form->eventtype = clean_param($form->eventtype, PARAM_ALPHA);
+    $form->instance = clean_param($form->instance, PARAM_INT);
+    $form->format = clean_param($form->format, PARAM_INT);
+    $form->action = clean_param($form->action, PARAM_ALPHA);
+    $form->type = clean_param($form->type, PARAM_ALPHA);
+    $form->course = clean_param($form->course, PARAM_INT);
 
     if(empty($form->name)) {
         $err['name'] = get_string('errornoeventname', 'calendar');
@@ -592,7 +620,7 @@ function validate_form(&$form, &$err) {
     if (!empty($form->repeat) and !($form->repeats > 1 and $form->repeats < 100)) {
         $err['repeats'] = get_string('errorinvalidrepeats', 'calendar');
     }
-    if(!empty($form->courseid)) {
+    if (!empty($form->courseid)) {
         // Timestamps must be >= course startdate
         $course = get_record('course', 'id', $form->courseid);
         if($course === false) {
@@ -602,6 +630,13 @@ function validate_form(&$form, &$err) {
             $err['timestart'] = get_string('errorbeforecoursestart', 'calendar');
         }
     }
+    if (!empty($form->modulename)) {
+        // Check that passed modulename actually exists (possible SQL Injection route)
+        $module = get_record('modules', 'name', $form->modulename);
+        if ($module === false) {
+            error('Invalid module name');
+        }
+    }
 }
 
 function calendar_add_event_allowed($event) {
-- 
2.43.0