debian/0000755000000000000000000000000012070345302007162 5ustar debian/postinst0000755000000000000000000001575112055712311011005 0ustar #!/bin/sh # postinst script for moodle # # see: dh_installdeb(1) # # summary of how this script can be called: # * `configure' # * `abort-upgrade' # * `abort-remove' `in-favour' # # * `abort-remove' # * `abort-deconfigure' `in-favour' # `removing' # # for details, see http://www.debian.org/doc/debian-policy/ or # the debian-policy package set -e #set -x if [ -f /etc/dbconfig-common/moodle.conf ] ; then . /etc/dbconfig-common/moodle.conf fi # source debconf stuff . /usr/share/debconf/confmodule # source dbconfig-common stuff . /usr/share/dbconfig-common/dpkg/postinst check_php5mysql_notinstalled() { dpkg -s php5-mysql | grep Status | grep -q installed >/dev/null 2>&1 && return 1 return 0 } check_php5psql_notinstalled() { dpkg -s php5-pgsql | grep Status | grep -q installed >/dev/null 2>&1 && return 1 return 0 } moodle_config() { local cfile=/etc/moodle/config.php local tempfile=`tempfile` local wwwroot db_get moodle/www wwwroot="$RET" if [ -z "$dbc_dbserver" ]; then dbc_dbserver="localhost"; fi if [ "$dbc_dbtype" = "pgsql" ]; then dbc_dbtype="postgres7" fi cat > $tempfile <dbtype = '${dbc_dbtype}'; \$CFG->dbhost = '${dbc_dbserver}'; \$CFG->dbname = '${dbc_dbname}'; \$CFG->dbuser = '${dbc_dbuser}'; \$CFG->dbpass = '${dbc_dbpass}'; \$CFG->prefix = 'mdl_'; \$CFG->wwwroot = '${wwwroot}'; \$CFG->dirroot = '/usr/share/moodle'; \$CFG->dataroot = '/var/lib/moodle'; \$CFG->directorypermissions = 0750; \$CFG->admin = 'admin'; \$CFG->pathtodu = '/usr/bin/du'; \$CFG->unzip = '/usr/bin/unzip'; \$CFG->zip = '/usr/bin/zip'; \$CFG->respectsessionsettings = true; # For improved security, make sure html purifier is used. \$CFG->enablehtmlpurifier = true; if (file_exists("\$CFG->dirroot/lib/setup.php")) { // Do not edit include_once("\$CFG->dirroot/lib/setup.php"); } else { if (\$CFG->dirroot == dirname(__FILE__)) { echo "

Could not find this file: \$CFG->dirroot/lib/setup.php

"; echo "

Are you sure all your files have been uploaded?

"; } else { echo "

Error detected in config.php

"; echo "

Error in: \\\$CFG->dirroot = '\$CFG->dirroot';

"; echo "

Try this: \\\$CFG->dirroot = '".dirname(__FILE__)."';

"; } die; } // MAKE SURE WHEN YOU EDIT THIS FILE THAT THERE ARE NO SPACES, BLANK LINES, // RETURNS, OR ANYTHING ELSE AFTER THE TWO CHARACTERS ON THE NEXT LINE. ?> EOF ucf --debconf-ok $tempfile $cfile chmod 640 $cfile chown www-data:www-data $cfile } apache_config() { local wwwroot local alias local tmp local tempfile=`tempfile` local cfile="/etc/moodle/apache.conf" local php_settings php_settings=" php_flag magic_quotes_gpc Off php_flag magic_quotes_runtime Off php_flag file_uploads On php_flag short_open_tag On php_flag session.auto_start Off php_flag session.bug_compat_warn Off php_value upload_max_filesize 2M php_value post_max_size 2M " db_get moodle/www wwwroot="$RET" #check if it's possible to do the alias tmp=`echo $wwwroot | sed 's#^https*://[^/]*/*##'` if [ -n "$tmp" ]; then tmp_alias="#Uncomment the line below if you want to use alias #This will not work well with virtual hosts Alias /${tmp} /usr/share/moodle/" else tmp_alias="#You can't use alias becuse you Moodls is not in a sub-directory #Create appropriate virtual host insted." fi cat > $tempfile < Options +FollowSymLinks AllowOverride None order deny,allow deny from all allow from 127.0.0.0/255.0.0.0 allow from localhost #comment out the line below to allow remote access #allow from all ${php_settings} DirectoryIndex index.php EOF ucf --debconf-ok $tempfile $cfile chmod 640 $cfile chown www-data:www-data $cfile #Sample config for the virtual host tempfile=`tempfile` cfile="/etc/moodle/apache.vhost.conf" server=`echo $wwwroot |cut -d'/' -f3` cat > $tempfile < ServerAdmin webmaster@${server} ServerName ${server} DocumentRoot /usr/share/moodle/ Options Indexes FollowSymLinks MultiViews AllowOverride None Order allow,deny allow from all ${php_settings} ErrorLog \${APACHE_LOG_DIR}/error.log # Possible values include: debug, info, notice, warn, error, crit, # alert, emerg. LogLevel warn CustomLog \${APACHE_LOG_DIR}/access.log combined EOF ucf --debconf-ok $tempfile $cfile chmod 640 $cfile chown www-data:www-data $cfile } dbc_mysql_createdb_encoding="UTF8" dbc_pgsql_createdb_encoding="UTF8" dbc_first_version="1.9.8-1" dbc_go moodle $@ #wwwroot="http://localhost/moodle" case "$1" in configure) # tempcfile=`tempfile` moodle_config apache_config # ucf --debconf-ok $tempfile $cfile # chmod 640 $cfile # chown www-data:www-data $cfile cfile=/etc/moodle/config.php moodledir=/usr/share/moodle # if [ -r /etc/moodle/config.php ]; then [ -f $moodledir/config.php ] && rm $moodledir/config.php ln -s $cfile $moodledir/config.php # fi # Make sure the link is correct (#603255) rm -rf /usr/share/moodle/lib/yui/2.9.0/build ln -s /usr/share/javascript/yui /usr/share/moodle/lib/yui/2.9.0/build repository=/var/lib/moodle if [ -d $repository ]; then chown -R www-data:www-data $repository chmod 0750 $repository fi if [ "$dbc_dbtype" = "mysql" ] && check_php5mysql_notinstalled ; then echo 'Error - You have specified that you wish to use a mysql' >&2 echo 'database, but php5-mysql is not installed. You must install' >&2 echo 'php5-mysql before you can complete your moodle installation.' >&2 fi if [ "$dbc_dbtype" = "postgresql" ] && check_php5psql_notinstalled ; then echo 'Error - You have specified that you wish to use a postgresql' >&2 echo 'database, but php5-pgsql is not installed. You must install' >&2 echo 'php5-pgsql before you can complete your moodle installation.' >&2 fi ;; abort-upgrade|abort-remove|abort-deconfigure) ;; *) echo "postinst called with unknown argument \`$1'" >&2 exit 1 ;; esac #DEBHELPER# exit 0 debian/moodle.cron.d0000644000000000000000000000026112055712311011546 0ustar # Regular cron jobs for the moodle package */15 * * * * www-data [ -f /usr/share/moodle/admin/cli/cron.php ] && /usr/bin/php -f /usr/share/moodle/admin/cli/cron.php > /dev/null debian/README.source0000644000000000000000000000040412055712311011340 0ustar Two .swf files were removed from the upstream source: * filter/mediaplugin/flvplayer.swf * filter/mediaplugin/mp3player.swf The reason is lack of the source code. Hopefully Moodle will change the flash player, see: http://tracker.moodle.org/browse/MDL-23870 debian/control0000644000000000000000000000232212055712311010565 0ustar Source: moodle Section: web Priority: optional Maintainer: Moodle Packaging Team Uploaders: Penny Leach , Xavier Oswald , Tomasz Muras DM-Upload-Allowed: yes Build-Depends: debhelper (>= 7), quilt, po-debconf Standards-Version: 3.9.3 Homepage: http://www.moodle.org/ Vcs-Git: git://git.debian.org/git/pkg-moodle/moodle.git Vcs-Browser: http://git.debian.org/?p=pkg-moodle/moodle.git;a=summary Package: moodle Architecture: all Depends: ${misc:Depends}, libapache2-mod-php5 | php5-cgi, php5-mysql | php5-pgsql, php5-gd, php5-curl, php5-cli, apache2-mpm-prefork | httpd, ucf, postgresql-client | mysql-client, libjs-yui, dbconfig-common Pre-Depends: debconf (>= 0.5) | debconf-2.0 Recommends: postgresql | mysql-server, php5-ldap, php5-xmlrpc, aspell, mimetex Suggests: clamav Description: course management system for online learning Moodle (Modular Object-Oriented Dynamic Learning Environment) is a course management system - a software package designed to help educators create quality online courses. One of the main advantages of Moodle over other systems is a strong grounding in social constructionist pedagogy. debian/patches/0000755000000000000000000000000012062145323010613 5ustar debian/patches/0018-MDL-34448-mod-data-Fixing-separate-groups-viewing-al.patch0000644000000000000000000001311512055712311023407 0ustar From b562dfba48402c2692ef4f3d39e672c740e46eab Mon Sep 17 00:00:00 2001 From: Adrian Greeve Date: Tue, 2 Oct 2012 15:52:00 +0800 Subject: [PATCH] MDL-34448 - mod/data - Fixing separate groups viewing all entries. --- mod/data/lib.php | 32 +++++++++++++++++++------------- mod/data/view.php | 28 +++++++++++++++++++++++++--- mod/upgrade.txt | 7 +++++++ 3 files changed, 51 insertions(+), 16 deletions(-) --- a/mod/data/lib.php +++ b/mod/data/lib.php @@ -3472,21 +3472,28 @@ /** * Get all of the record ids from a database activity. * - * @param int $dataid The dataid of the database module. - * @return array $idarray An array of record ids + * @param int $dataid The dataid of the database module. + * @param object $selectdata Contains an additional sql statement for the + * where clause for group and approval fields. + * @param array $params Parameters that coincide with the sql statement. + * @return array $idarray An array of record ids */ -function data_get_all_recordids($dataid) { +function data_get_all_recordids($dataid, $selectdata = '', $params = null) { global $DB; - $initsql = 'SELECT c.recordid - FROM {data_fields} f, - {data_content} c - WHERE f.dataid = :dataid - AND f.id = c.fieldid - GROUP BY c.recordid'; - $initrecord = $DB->get_recordset_sql($initsql, array('dataid' => $dataid)); + $initsql = 'SELECT r.id + FROM {data_records} r + WHERE r.dataid = :dataid'; + if ($selectdata != '') { + $initsql .= $selectdata; + $params = array_merge(array('dataid' => $dataid), $params); + } else { + $params = array('dataid' => $dataid); + } + $initsql .= ' GROUP BY r.id'; + $initrecord = $DB->get_recordset_sql($initsql, $params); $idarray = array(); foreach ($initrecord as $data) { - $idarray[] = $data->recordid; + $idarray[] = $data->id; } // Close the record set and free up resources. $initrecord->close(); @@ -3631,8 +3638,7 @@ } else { list($insql, $inparam) = $DB->get_in_or_equal(array('-1'), SQL_PARAMS_NAMED); } - $nestfromsql .= ' AND c.recordid ' . $insql . $groupsql; - $nestfromsql = "$nestfromsql $selectdata"; + $nestfromsql .= ' AND c.recordid ' . $insql . $selectdata . $groupsql; $sqlselect['sql'] = "$nestselectsql $nestfromsql $sortorder"; $sqlselect['params'] = $inparam; return $sqlselect; --- a/mod/data/view.php +++ b/mod/data/view.php @@ -322,6 +322,13 @@ groups_print_activity_menu($cm, $returnurl); $currentgroup = groups_get_activity_group($cm); $groupmode = groups_get_activity_groupmode($cm); + // If a student is not part of a group and seperate groups is enabled, we don't + // want them seeing all records. + if ($currentgroup == 0 && $groupmode == 1 && !has_capability('mod/data:manageentries', $context)) { + $canviewallrecords = false; + } else { + $canviewallrecords = true; + } // detect entries not approved yet and show hint instead of not found error if ($record and $data->approval and !$record->approved and $record->userid != $USER->id and !has_capability('mod/data:manageentries', $context)) { @@ -466,7 +473,13 @@ $groupselect = " AND (r.groupid = :currentgroup OR r.groupid = 0)"; $params['currentgroup'] = $currentgroup; } else { - $groupselect = ' '; + if ($canviewallrecords) { + $groupselect = ' '; + } else { + // If separate groups are enabled and the user isn't in a group or + // a teacher, manager, admin etc, then just show them entries for 'All participants'. + $groupselect = " AND r.groupid = 0"; + } } // Init some variables to be used by advanced search @@ -590,10 +603,19 @@ $fromsql = "FROM $tables $advtables $where $advwhere $groupselect $approveselect $searchselect $advsearchselect"; $allparams = array_merge($params, $advparams); - $recordids = data_get_all_recordids($data->id); + // Provide initial sql statements and parameters to reduce the number of total records. + $selectdata = $groupselect . $approveselect; + $initialparams = array(); + if ($currentgroup) { + $initialparams['currentgroup'] = $params['currentgroup']; + } + if (!$approvecap && $data->approval && isloggedin()) { + $initialparams['myid1'] = $params['myid1']; + } + + $recordids = data_get_all_recordids($data->id, $selectdata, $initialparams); $newrecordids = data_get_advance_search_ids($recordids, $search_array, $data->id); $totalcount = count($newrecordids); - $selectdata = $groupselect . $approveselect; if (!empty($advanced)) { $advancedsearchsql = data_get_advanced_search_sql($sort, $data, $newrecordids, $selectdata, $sortorder); --- a/mod/upgrade.txt +++ b/mod/upgrade.txt @@ -10,12 +10,19 @@ * textlib->asort() replaced by specialized collatorlib::asort() * use new make_temp_directory() and make_cache_directory() +optional - no changes needed: + +* mod/data/lib.php data_get_all_recordids() now has two new optional variables: $selectdata and $params. === 2.1 === required changes in code: * add new support for basic restore from 1.9 +optional - no changes needed: + +* mod/data/lib.php data_get_all_recordids() now has two new optional variables: $selectdata and $params. + === 2.0 === debian/patches/0005-MDL-33808-incorrect-cleaning-of-repository-names.patch0000644000000000000000000000324512055712311023004 0ustar From f0a7254635f6be0fda60df372a4a174d8eac13f2 Mon Sep 17 00:00:00 2001 From: Dan Poltawski Date: Tue, 19 Jun 2012 11:20:21 +0800 Subject: MDL-33808 - incorrect cleaning of repository names --- repository/lib.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/repository/lib.php b/repository/lib.php index eae6072..3c10b43 100644 --- a/repository/lib.php +++ b/repository/lib.php @@ -1450,7 +1450,7 @@ abstract class repository { $ft = new filetype_parser; $meta = new stdClass(); $meta->id = $this->id; - $meta->name = $this->get_name(); + $meta->name = format_string($this->get_name()); $meta->type = $this->options['type']; $meta->icon = $OUTPUT->pix_url('icon', 'repository_'.$meta->type)->out(false); $meta->supported_types = $ft->get_extensions($this->supported_filetypes()); @@ -1762,6 +1762,7 @@ abstract class repository { // it can be empty, then moodle will look for instance name from language string $mform->addElement('text', 'pluginname', get_string('pluginname', 'repository'), array('size' => '40')); $mform->addElement('static', 'pluginnamehelp', '', get_string('pluginnamehelp', 'repository')); + $mform->setType('pluginname', PARAM_TEXT); } } @@ -1904,6 +1905,7 @@ final class repository_instance_form extends moodleform { $mform->addElement('text', 'name', get_string('name'), 'maxlength="100" size="30"'); $mform->addRule('name', $strrequired, 'required', null, 'client'); + $mform->setType('name', PARAM_TEXT); } public function definition() { -- 1.7.10.4 debian/patches/0011-MDL-28207-Course-Showing-hiding-marking-a-section-re.patch0000644000000000000000000003025712055712311023341 0ustar From 755dac1e2f3d82853ce12c91d36ee01f1b5501e2 Mon Sep 17 00:00:00 2001 From: Frederic Massart Date: Tue, 31 Jul 2012 14:10:05 +0800 Subject: [PATCH] MDL-28207 Course: Showing/hiding/marking a section respect capabilities --- course/format/topics/format.php | 46 +++++++++++++++++++++------------------ course/format/weeks/format.php | 34 ++++++++++++++++------------- course/rest.php | 5 +++-- course/view.php | 5 +++-- 4 files changed, 50 insertions(+), 40 deletions(-) diff --git a/course/format/topics/format.php b/course/format/topics/format.php index b8ce8f2..0c58c4d 100644 --- a/course/format/topics/format.php +++ b/course/format/topics/format.php @@ -186,29 +186,33 @@ while ($section <= $course->numsections) { ''.$strshowonlytopic.'
'; } - if ($PAGE->user_is_editing() && has_capability('moodle/course:update', get_context_instance(CONTEXT_COURSE, $course->id))) { - - if ($course->marker == $section) { // Show the "light globe" on/off - echo ''.''.$strmarkedthistopic.'
'; - } else { - echo ''.''.$strmarkthistopic.'
'; - } - - if ($thissection->visible) { // Show the hide/show eye - echo ''. - ''.$strtopichide.'
'; - } else { - echo ''. - ''.$strtopicshow.'
'; + $coursecontext = context_course::instance($course->id); + if ($PAGE->user_is_editing()) { + if (has_capability('moodle/course:setcurrentsection', $coursecontext)) { + if ($course->marker == $section) { // Show the "light globe" on/off + echo ''.''.$strmarkedthistopic.'
'; + } else { + echo ''.''.$strmarkthistopic.'
'; + } } - if ($section > 1) { // Add a arrow to move section up - echo ''. - ''.$strmoveup.'
'; + if (has_capability('moodle/course:sectionvisibility', $coursecontext)) { + if ($thissection->visible) { // Show the hide/show eye + echo ''. + ''.$strtopichide.'
'; + } else { + echo ''. + ''.$strtopicshow.'
'; + } } - - if ($section < $course->numsections) { // Add a arrow to move section down - echo ''. - ''.$strmovedown.'
'; + if (has_capability('moodle/course:update', $coursecontext)) { + if ($section > 1) { // Add a arrow to move section up + echo ''. + ''.$strmoveup.'
'; + } + if ($section < $course->numsections) { // Add a arrow to move section down + echo ''. + ''.$strmovedown.'
'; + } } } echo ''; diff --git a/course/format/weeks/format.php b/course/format/weeks/format.php index c5c78fa..9ae93f1 100644 --- a/course/format/weeks/format.php +++ b/course/format/weeks/format.php @@ -192,22 +192,26 @@ defined('MOODLE_INTERNAL') || die(); ''.$strshowonlyweek.'
'; } - if ($PAGE->user_is_editing() && has_capability('moodle/course:update', get_context_instance(CONTEXT_COURSE, $course->id))) { - if ($thissection->visible) { // Show the hide/show eye - echo ''. - ''.$strweekhide.'
'; - } else { - echo ''. - ''.$strweekshow.'
'; - } - if ($section > 1) { // Add a arrow to move section up - echo ''. - ''.$strmoveup.'
'; + $coursecontext = context_course::instance($course->id); + if ($PAGE->user_is_editing()) { + if (has_capability('moodle/course:sectionvisibility', $coursecontext)) { + if ($thissection->visible) { // Show the hide/show eye + echo ''. + ''.$strweekhide.'
'; + } else { + echo ''. + ''.$strweekshow.'
'; + } } - - if ($section < $course->numsections) { // Add a arrow to move section down - echo ''. - ''.$strmovedown.'
'; + if (has_capability('moodle/course:update', $coursecontext)) { + if ($section > 1) { // Add a arrow to move section up + echo ''. + ''.$strmoveup.'
'; + } + if ($section < $course->numsections) { // Add a arrow to move section down + echo ''. + ''.$strmovedown.'
'; + } } } echo ''; diff --git a/course/rest.php b/course/rest.php index 5125ffb..3f996a7 100644 --- a/course/rest.php +++ b/course/rest.php @@ -78,7 +78,6 @@ switch($requestmethod) { case 'section': require_login($course); $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id); - require_capability('moodle/course:update', $coursecontext); if (!$DB->record_exists('course_sections', array('course'=>$course->id, 'section'=>$id))) { error_log('AJAX commands.php: Bad Section ID '.$id); @@ -87,10 +86,12 @@ switch($requestmethod) { switch ($field) { case 'visible': + require_capability('moodle/course:sectionvisibility', $coursecontext); set_section_visible($course->id, $id, $value); break; case 'move': + require_capability('moodle/course:update', $coursecontext); move_section_to($course, $id, $value); break; } @@ -158,7 +159,7 @@ switch($requestmethod) { case 'marker': require_login($course); $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id); - require_capability('moodle/course:update', $coursecontext); + require_capability('moodle/course:setcurrentsection', $coursecontext); course_set_marker($course->id, $value); break; } diff --git a/course/view.php b/course/view.php index 8b2621f..816265e 100644 --- a/course/view.php +++ b/course/view.php @@ -127,15 +127,16 @@ } } - if (has_capability('moodle/course:update', $context)) { + if (has_capability('moodle/course:sectionvisibility', $context)) { if ($hide && confirm_sesskey()) { set_section_visible($course->id, $hide, '0'); } - if ($show && confirm_sesskey()) { set_section_visible($course->id, $show, '1'); } + } + if (has_capability('moodle/course:update', $context)) { if (!empty($section)) { if (!empty($move) and confirm_sesskey()) { if (move_section($course, $section, $move)) { -- 1.7.10.4 debian/patches/0002-MDL-34045-fix-invalid-idnumber-field-type-in-cohort-.patch0000644000000000000000000000213212055712311023331 0ustar From b0d2db5452a7210d2067d4b40b36d2bfad5a84c3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20=C5=A0koda?= Date: Sat, 30 Jun 2012 07:50:38 +0200 Subject: MDL-34045 fix invalid idnumber field type in cohort form --- cohort/edit_form.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cohort/edit_form.php b/cohort/edit_form.php index 249212c..d449980 100644 --- a/cohort/edit_form.php +++ b/cohort/edit_form.php @@ -49,7 +49,7 @@ class cohort_edit_form extends moodleform { $mform->addElement('select', 'contextid', get_string('context', 'role'), $options); $mform->addElement('text', 'idnumber', get_string('idnumber', 'cohort'), 'maxlength="254" size="50"'); - $mform->setType('name', PARAM_RAW); // idnumbers are plain text, must not be changed + $mform->setType('idnumber', PARAM_RAW); // idnumbers are plain text, must not be changed $mform->addElement('editor', 'description_editor', get_string('description', 'cohort'), null, $editoroptions); $mform->setType('description_editor', PARAM_RAW); -- 1.7.10.4 debian/patches/0013-MDL-34519-Course-reset-not-protected-by-proper-capab.patch0000644000000000000000000000156512055712311023446 0ustar From f4ab33b25ff2013d8334303a06fde1800cd8cce0 Mon Sep 17 00:00:00 2001 From: Rex Lorenzo Date: Tue, 24 Jul 2012 12:01:11 -0700 Subject: [PATCH] MDL-34519 - Course reset not protected by proper capability --- course/reset.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/course/reset.php b/course/reset.php index cd0a66b..088c203 100644 --- a/course/reset.php +++ b/course/reset.php @@ -39,7 +39,7 @@ if (!$course = $DB->get_record('course', array('id'=>$id))) { $PAGE->set_url('/course/reset.php', array('id'=>$id)); require_login($course); -require_capability('moodle/course:update', get_context_instance(CONTEXT_COURSE, $course->id)); +require_capability('moodle/course:reset', get_context_instance(CONTEXT_COURSE, $course->id)); $strreset = get_string('reset'); $strresetcourse = get_string('resetcourse'); -- 1.7.10.4 debian/patches/0017-MDL-32785-lib-Ignorning-hard-frozen-fields-when-subm.patch0000644000000000000000000000316712055712311023411 0ustar From a8a779115c15dcd57948bf0f3dc56624c35c6a9c Mon Sep 17 00:00:00 2001 From: Adrian Greeve Date: Thu, 30 Aug 2012 15:42:54 +0800 Subject: [PATCH] MDL-32785 - lib - Ignorning hard frozen fields when submitting data. --- lib/formslib.php | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) --- a/lib/formslib.php +++ b/lib/formslib.php @@ -1625,10 +1625,14 @@ $unfiltered = array(); if (null === $elementList) { // iterate over all elements, calling their exportValue() methods - $emptyarray = array(); foreach (array_keys($this->_elements) as $key) { - if ($this->_elements[$key]->isFrozen() && !$this->_elements[$key]->_persistantFreeze){ - $value = $this->_elements[$key]->exportValue($emptyarray, true); + if ($this->_elements[$key]->isFrozen() && !$this->_elements[$key]->_persistantFreeze) { + $varname = $this->_elements[$key]->_attributes['name']; + $value = ''; + // If we have a default value then export it. + if (isset($this->_defaultValues[$varname])) { + $value = array($varname => $this->_defaultValues[$varname]); + } } else { $value = $this->_elements[$key]->exportValue($this->_submitValues, true); } @@ -1655,7 +1659,6 @@ if (is_array($this->_constantValues)) { $unfiltered = HTML_QuickForm::arrayMerge($unfiltered, $this->_constantValues); } - return $unfiltered; } /** debian/patches/0019-MDL-33791-Portfolio-Fixed-security-issue-with-passin.patch0000644000000000000000000001037612055712311023600 0ustar From 1be0790e015b4fcbb59778d7e79892761230fd84 Mon Sep 17 00:00:00 2001 From: Mark Nelson Date: Wed, 7 Nov 2012 16:39:01 +0800 Subject: [PATCH] MDL-33791 Portfolio: Fixed security issue with passing file paths. --- lib/portfoliolib.php | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++ portfolio/add.php | 11 +++----- 2 files changed, 72 insertions(+), 7 deletions(-) --- a/lib/portfoliolib.php +++ b/lib/portfoliolib.php @@ -1237,6 +1237,74 @@ return $format->file_output($file, $options); } +/** +* Function to require any potential callback files, throwing exceptions +* if an issue occurs. +* +* @param string $callbackfile This is the location of the callback file '/mod/forum/locallib.php' +* @param string $class Name of the class containing the callback functions +* activity components should ALWAYS use their name_portfolio_caller +* other locations must use something unique +*/ +function portfolio_include_callback_file($callbackfile, $class = null) { + global $CFG; + require_once($CFG->libdir . '/adminlib.php'); + + // Get the last occurrence of '/' in the file path. + $pos = strrpos($callbackfile, '/'); + // Get rid of the first slash (if it exists). + $callbackfile = ltrim($callbackfile, '/'); + // Get a list of valid plugin types. + $plugintypes = get_plugin_types(false); + // Assume it is not valid for now. + $isvalid = false; + // Go through the plugin types. + foreach ($plugintypes as $type => $path) { + if (strrpos($callbackfile, $path) === 0) { + // Found the plugin type. + $isvalid = true; + $plugintype = $type; + $pluginpath = $path; + } + } + // Throw exception if not a valid component. + if (!$isvalid) { + throw new coding_exception('Somehow a non-valid plugin path was passed, could be a hackz0r attempt, exiting.'); + } + // Keep record of the filename. + $filename = substr($callbackfile, $pos); + // Remove the file name. + $component = trim(substr($callbackfile, 0, $pos), '/'); + // Replace the path with the type. + $component = str_replace($pluginpath, $plugintype, $component); + // Ok, replace '/' with '_'. + $component = str_replace('/', '_', $component); + // Check that it is a valid component. + if (!get_component_version($component)) { + throw new portfolio_button_exception('nocallbackcomponent', 'portfolio', '', $component); + } + + // Obtain the component's location. + if (!$componentloc = get_component_directory($component)) { + throw new portfolio_button_exception('nocallbackcomponent', 'portfolio', '', $component); + } + + // Check if the filename does not meet any of the expected names. + if (($filename != 'locallib.php') && ($filename != 'portfoliolib.php') && ($filename != 'portfolio_callback.php')) { + debugging('Please standardise your plugin by keeping your portfolio callback functionality in the file locallib.php.', DEBUG_DEVELOPER); + } + + // Throw error if file does not exist. + if (!file_exists($componentloc . '/' . $filename)) { + throw new portfolio_button_exception('nocallbackfile', 'portfolio', '', $callbackfile); + } + + require_once($componentloc . '/' . $filename); + + if (!is_null($class) && !class_exists($class)) { + throw new portfolio_button_exception('nocallbackclass', 'portfolio', '', $class); + } +} /** * go through all the @@PLUGINFILE@@ matches in some text, --- a/portfolio/add.php +++ b/portfolio/add.php @@ -176,13 +176,10 @@ $callbackargs[substr($key, 3)] = $value; } } - // righto, now we have the callback args set up - // load up the caller file and class and tell it to set up all the data - // it needs - require_once($CFG->dirroot . $callbackfile); - if (!class_exists($callbackclass) || !is_subclass_of($callbackclass, 'portfolio_caller_base')) { - throw new portfolio_caller_exception('callbackclassinvalid', 'portfolio'); - } + + // Ensure that we found a file we can use, if not throw an exception. + portfolio_include_callback_file($callbackfile, $callbackclass); + $caller = new $callbackclass($callbackargs); $caller->set('user', $USER); if ($formats = explode(',', $callerformats)) { debian/patches/0014-MDL-34368-Fix-broken-query-in-so-tokens-are-correctl.patch0000644000000000000000000000216112055712311023367 0ustar From af6df710114918fbdf51486bbcca8049a2e72cba Mon Sep 17 00:00:00 2001 From: Nathan Mares Date: Tue, 17 Jul 2012 19:11:57 +1000 Subject: [PATCH] MDL-34368: Fix broken query in so tokens are correctly checked against the linked service --- webservice/lib.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/webservice/lib.php b/webservice/lib.php index 1861513..998edd9 100644 --- a/webservice/lib.php +++ b/webservice/lib.php @@ -979,7 +979,7 @@ abstract class webservice_zend_server extends webservice_server { FROM {external_services} s JOIN {external_services_functions} sf ON (sf.externalserviceid = s.id AND s.restrictedusers = 1) JOIN {external_services_users} su ON (su.externalserviceid = s.id AND su.userid = :userid) - WHERE s.enabled = 1 AND su.validuntil IS NULL OR su.validuntil < :now $wscond2"; + WHERE s.enabled = 1 AND (su.validuntil IS NULL OR su.validuntil < :now) $wscond2"; $params = array_merge($params, array('userid'=>$USER->id, 'now'=>time())); -- 1.7.10.4 debian/patches/0009-MDL-30792-Files-API-maxbytes-will-be-set-by-get_max_.patch0000644000000000000000000000344012055712311023134 0ustar From ebf253af171efbc5ff3a0074538c85a5edcb2ee2 Mon Sep 17 00:00:00 2001 From: Rajesh Taneja Date: Fri, 3 Aug 2012 11:44:20 +0800 Subject: [PATCH] MDL-30792 Files API: maxbytes will be set by get_max_upload_file_size if less then 0 or greater then max moodle limit --- repository/filepicker.php | 4 ++-- repository/repository_ajax.php | 8 ++++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/repository/filepicker.php b/repository/filepicker.php index 68aee10..610ef13 100644 --- a/repository/filepicker.php +++ b/repository/filepicker.php @@ -93,9 +93,9 @@ if ($repository = $DB->get_record_sql($sql, array($repo_id))) { } } -$moodle_maxbytes = get_max_upload_file_size(); +$moodle_maxbytes = get_max_upload_file_size($CFG->maxbytes, $course->maxbytes); // to prevent maxbytes greater than moodle maxbytes setting -if ($maxbytes == 0 || $maxbytes>=$moodle_maxbytes) { +if (($maxbytes <= 0) || ($maxbytes >= $moodle_maxbytes)) { $maxbytes = $moodle_maxbytes; } diff --git a/repository/repository_ajax.php b/repository/repository_ajax.php index b7793c8..b7f76d1 100644 --- a/repository/repository_ajax.php +++ b/repository/repository_ajax.php @@ -83,9 +83,13 @@ if (!$repository = $DB->get_record_sql($sql, array($repo_id))) { /// Check permissions repository::check_capability($contextid, $repository); -$moodle_maxbytes = get_max_upload_file_size(); +$coursemaxbytes = 0; +if (!empty($course)) { + $coursemaxbytes = $course->maxbytes; +} +$moodle_maxbytes = get_max_upload_file_size($CFG->maxbytes, $coursemaxbytes); // to prevent maxbytes greater than moodle maxbytes setting -if ($maxbytes == 0 || $maxbytes>=$moodle_maxbytes) { +if (($maxbytes <= 0) || ($maxbytes >= $moodle_maxbytes)) { $maxbytes = $moodle_maxbytes; } -- 1.7.10.4 debian/patches/0007-MDL-31692-mod_lti-ensure-that-various-mforms-are-use.patch0000644000000000000000000001760412055712311023535 0ustar From 1d161e6802bc352c38014f59ed6eb4f63f860378 Mon Sep 17 00:00:00 2001 From: Dan Poltawski Date: Fri, 22 Jun 2012 14:42:20 +0800 Subject: [PATCH 7/8] MDL-31692 mod_lti - ensure that various mforms are used properly * typesettings.php and instructor_edit_tool_type.php are tided up properly to ensure proper use for form data * An incorrect PARAM type is corrected for typename --- mod/lti/edit_form.php | 2 +- mod/lti/instructor_edit_tool_type.php | 9 +-- mod/lti/typessettings.php | 131 ++++++++------------------------- 3 files changed, 34 insertions(+), 108 deletions(-) diff --git a/mod/lti/edit_form.php b/mod/lti/edit_form.php index 3cf2ef8..fec78ee 100644 --- a/mod/lti/edit_form.php +++ b/mod/lti/edit_form.php @@ -62,7 +62,7 @@ class mod_lti_edit_types_form extends moodleform{ $mform->addElement('header', 'setup', get_string('tool_settings', 'lti')); $mform->addElement('text', 'lti_typename', get_string('typename', 'lti')); - $mform->setType('lti_typename', PARAM_INT); + $mform->setType('lti_typename', PARAM_TEXT); $mform->addHelpButton('lti_typename', 'typename', 'lti'); $mform->addRule('lti_typename', null, 'required', null, 'client'); diff --git a/mod/lti/instructor_edit_tool_type.php b/mod/lti/instructor_edit_tool_type.php index b0fe496..c65b3f4 100644 --- a/mod/lti/instructor_edit_tool_type.php +++ b/mod/lti/instructor_edit_tool_type.php @@ -47,9 +47,8 @@ if (!empty($typeid)) { } } -$data = data_submitted(); - -if (isset($data->submitbutton) && confirm_sesskey()) { +$form = new mod_lti_edit_types_form(); +if ($data = $form->get_data()) { $type = new stdClass(); if (!empty($typeid)) { @@ -96,7 +95,7 @@ if (isset($data->submitbutton) && confirm_sesskey()) { die; } -} else if (isset($data->cancel)) { +} else if ($form->is_cancelled()) { $script = "