MDL-63834 core_message: validate conversation type before creating

diff --git a/message/classes/api.php b/message/classes/api.php
index b732e03..c7ccff4 100644 (file)
--- a/message/classes/api.php
+++ b/message/classes/api.php
@@ -1681,6 +1681,15 @@ class api {
 
         global $DB;
 
+        $validtypes = [
+            self::MESSAGE_CONVERSATION_TYPE_INDIVIDUAL,
+            self::MESSAGE_CONVERSATION_TYPE_GROUP
+        ];
+
+        if (!in_array($type, $validtypes)) {
+            throw new \moodle_exception('An invalid conversation type was specified.');
+        }
+
         // Sanity check.
         if ($type == self::MESSAGE_CONVERSATION_TYPE_INDIVIDUAL) {
             if (count($userids) > 2) {

diff --git a/message/tests/api_test.php b/message/tests/api_test.php
index 89567e2..f18009d 100644 (file)
--- a/message/tests/api_test.php
+++ b/message/tests/api_test.php
@@ -3945,6 +3945,14 @@ class core_message_api_testcase extends core_message_messagelib_testcase {
         $this->assertEquals($conversation->id, $member3->conversationid);
     }
 
+    /**
+     * Test creating an invalid conversation.
+     */
+    public function test_create_conversation_invalid() {
+        $this->expectException('moodle_exception');
+        \core_message\api::create_conversation(3, [1, 2, 3]);
+    }
+
     /**
      * Test creating an individual conversation with too many members.
      */