Details
-
Type:
Bug
-
Status:
Closed
-
Priority:
Major
-
Resolution: Won't Fix
-
Affects Version/s: 1.6.1
-
Fix Version/s: None
-
Component/s: Gradebook
-
Labels:None
-
Environment:probably not relevent (RHEL, PHP 5.x mysql 5.x)
-
Database:MySQL
-
Affected Branches:MOODLE_16_STABLE
Description
Gradebook categories that incluide double quotes result in an error something like [[category non-numeric]] and the category weighting doesn't update. This is a minor bug but looks a bit like an sql injection issue.
The name of the form fields includes the name of the category. Changing category names to category ids solves the problem.
The file to modify is /moodle/grade/lib.php:
. line 39 change:
$sql = "SELECT id, weight, drop_x_lowest, bonus_points, hidden, c.id AS cat_id
FROM {$CFG->prefix}grade_category c
WHERE c.courseid=$course
AND c.name='$category'";
for:
$sql = "SELECT id, weight, drop_x_lowest, bonus_points, hidden, c.id AS cat_id
FROM {$CFG->prefix}grade_category c
WHERE c.courseid=$course
AND c.id='$category'";
. line 2247 change:
$submitted_category = optional_param($form_catname);
for:
$submitted_category = optional_param($category->id);
. line 2250 change:
$weight = grade_get_category_weight($course->id, $category->name);
for:
$weight = grade_get_category_weight($course->id, $category->id);
. line 2257 change:
$cur_drop = optional_param("drop_x_lowest$form_catname");
$cur_bonus_points = optional_param("bonus_points$form_catname");
$cur_hidden = optional_param("hidden$form_catname");
for:
$cur_drop = optional_param("drop_x_lowest$category->id");
$cur_bonus_points = optional_param("bonus_points$category->id");
$cur_hidden = optional_param("hidden$category->id");
. line 2234 change:
echo '<tr><td align="center" class="generalboxcontent">'.$category->name.'</td>';
echo '<td align="center" class="generalboxcontent"><input type="text" size="5" name="'.$form_catname.'" value="'.$val.'" /></td>';
echo '<td align="center" class="generalboxcontent"><input type="text" size="5" name="drop_x_lowest'.$form_catname.'" value="'.$category->drop_x_lowest.'" /></td>';
echo '<td align="center" class="generalboxcontent"><input type="text" size="5" name="bonus_points'.$form_catname.'" value="'.$category->bonus_points.'" /></td>';
echo '<td align="center" class="generalboxcontent"><input type="checkbox" name="hidden'.$form_catname.'" ';
for
$form_catid = $category->id;
echo '<tr><td align="center" class="generalboxcontent">'.$category->name.'</td>';
echo '<td align="center" class="generalboxcontent"><input type="text" size="5" name="'.$form_catid.'" value="'.$val.'" /></td>';
echo '<td align="center" class="generalboxcontent"><input type="text" size="5" name="drop_x_lowest'.$form_catid.'" value="'.$category->drop_x_lowest.'" /></td>';
echo '<td align="center" class="generalboxcontent"><input type="text" size="5" name="bonus_points'.$form_catid.'" value="'.$category->bonus_points.'" /></td>';
echo '<td align="center" class="generalboxcontent"><input type="checkbox" name="hidden'.$form_catid.'" ';