Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-33040

report date uses PARAM_FILE

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Minor
    • 2.1.7, 2.2.4
    • 2.1.6, 2.2.3, 2.3
    • Reports
    • MOODLE_21_STABLE, MOODLE_22_STABLE, MOODLE_23_STABLE
    • MOODLE_21_STABLE, MOODLE_22_STABLE
    • MDL-33040-master-1
    • Hide

      Open the log viewer
      Select some different dates and ensure that the correct log entries are displayed

      There may be some other tests you want to run here. This shouldn't make any difference, just actually sanitise the input correctly.

      Show
      Open the log viewer Select some different dates and ensure that the correct log entries are displayed There may be some other tests you want to run here. This shouldn't make any difference, just actually sanitise the input correctly.

    Description

      Just noticed that report/log/index.php has PARAM_FILE as it's type.
      It also states in it's comment:

      // Date to display - number or some string

      However, in looking into this:
      print_log() is called with $date, which passes the $date straight to build_logs_array() which in turn runs:

      if ($date) {
          $enddate = $date + 86400;
          $joins[] = "l.time > :date AND l.time < :enddate";
          $params['date'] = $date;
          $params['enddate'] = $enddate;
      }

      Specifying a string (e.g. now) just causes a database error. The string is passed in as a bind param so never evaled as a function (which is good).

      Vote to convert to a PARAM_INT and adjust the comment accordingly

      Attachments

        Activity

          People

            dobedobedoh Andrew Lyons
            dobedobedoh Andrew Lyons
            Sam Hemelryk Sam Hemelryk
            Aparup Banerjee Aparup Banerjee
            Ankit Agarwal Ankit Agarwal
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Clockify

                Error rendering 'clockify-timesheets-time-tracking-reports:timer-sidebar'. Please contact your Jira administrators.