Moodle

require parameter type in optional_param() and required_param()

Details

  • Type: Bug Bug
  • Status: Closed Closed
  • Priority: Major Major
  • Resolution: Fixed
  • Affects Version/s: 2.0
  • Fix Version/s: 2.0
  • Component/s: General
  • Labels:
    None
  • Affected Branches:
    MOODLE_20_STABLE
  • Fixed Branches:
    MOODLE_20_STABLE

Description

we kept the parameter type optional for BC reasons only, now is the time to enforce it!

Activity

Hide
Pierre Pichet added a comment -

Hi Petr
I agree to explicitely set PARAM types is you think it is necessary
However the moodlelib.php should also be modified
/**

  • Returns a particular value for the named variable, taken from
  • POST or GET, otherwise returning a given default.
    *
  • This function should be used to initialise all optional values
  • in a script that are based on parameters. Usually it will be
  • used like this:
  • $name = optional_param('name', 'Fred');
    *
  • @param string $parname the name of the page parameter we want
  • @param mixed $default the default value to return if nothing is found
  • @param int $type expected type of parameter, default PARAM_CLEAN
  • @return mixed
    */
    function optional_param($parname, $default=NULL, $type=PARAM_CLEAN) {
    ...

In the edit_calculatedsimple_form.php the default values were sufficient as in no case the values are stored directly in the database by this file.
They are further processed by the other edit questions flowchart including moodleforms functions.
As I did not want to interfere in the following processes, I did not specify further the PARAM TYPE and the default null so the simple calls $name = optional_param('name') were used.

The main aspect of edit_calculatedsimple_form.php is to put all the necessary parameters defined in the three pages edit___forms.php of calculated in one page without saving anything in the database until the user click on the SAVE button.
In this way there can be also a real CANCEL which is not the case for the calculated three pages actual process.

Show
Pierre Pichet added a comment - Hi Petr I agree to explicitely set PARAM types is you think it is necessary However the moodlelib.php should also be modified /**
  • Returns a particular value for the named variable, taken from
  • POST or GET, otherwise returning a given default. *
  • This function should be used to initialise all optional values
  • in a script that are based on parameters. Usually it will be
  • used like this:
  • $name = optional_param('name', 'Fred'); *
  • @param string $parname the name of the page parameter we want
  • @param mixed $default the default value to return if nothing is found
  • @param int $type expected type of parameter, default PARAM_CLEAN
  • @return mixed */ function optional_param($parname, $default=NULL, $type=PARAM_CLEAN) { ...
In the edit_calculatedsimple_form.php the default values were sufficient as in no case the values are stored directly in the database by this file. They are further processed by the other edit questions flowchart including moodleforms functions. As I did not want to interfere in the following processes, I did not specify further the PARAM TYPE and the default null so the simple calls $name = optional_param('name') were used. The main aspect of edit_calculatedsimple_form.php is to put all the necessary parameters defined in the three pages edit___forms.php of calculated in one page without saving anything in the database until the user click on the SAVE button. In this way there can be also a real CANCEL which is not the case for the calculated three pages actual process.
Hide
Petr Škoda (skodak) added a comment -

yes, the optional_param() is going to be changed in 2.0 - the default and type will be mandatory.
You should not be using the PARAM_CLEAN at all, it was just a "temporary" hack around Moodle 1.4 - you should always specify correct type even if you are processing it afterwards.

Show
Petr Škoda (skodak) added a comment - yes, the optional_param() is going to be changed in 2.0 - the default and type will be mandatory. You should not be using the PARAM_CLEAN at all, it was just a "temporary" hack around Moodle 1.4 - you should always specify correct type even if you are processing it afterwards.
Hide
Petr Škoda (skodak) added a comment -

It is mandatory since 2.0, closing.

Show
Petr Škoda (skodak) added a comment - It is mandatory since 2.0, closing.

People

Vote (0)
Watch (0)

Dates

  • Created:
    Updated:
    Resolved: