Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-49077

clean_param($x, PARAM_TEXT) does not work the way users expect regarding < characters

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Minor
    • Resolution: Duplicate
    • Affects Version/s: 2.8.3
    • Fix Version/s: None
    • Component/s: Libraries
    • Labels:
      None
    • Affected Branches:
      MOODLE_28_STABLE

      Description

      PARAM_TEXT is for multi-lang input. That is, more or less plain text with <lang> or <span> tags.

      What seems to be rather poorly defined is what happens to isolated < signs in the input.

      Users expect to be able to create activities with names like 'x < y', or matching questions with choices like that. And, you can do that, and it works.

      What does not work is if you try to do input like '<' or '<x'. Basically, if the < is not followed by a space, then it gets stripped. That is not what users expect.

      The bad news is that PARAM_TEXT is built on top of the PHP native function strip_tags. That is where the strange behaviour comes from. It is probably good for security, but it is bad for Moodle usability.

      Here are some unit tests. You can past them into the end of test_clean_param_text in lib/tests/moodlelib_test.php

       
              $this->assertSame('<', clean_param('<', PARAM_TEXT));
              $this->assertSame('<3', clean_param('<3', PARAM_TEXT));
              $this->assertSame('< 3', clean_param('< 3', PARAM_TEXT));
              $this->assertSame('1<', clean_param('1<', PARAM_TEXT));
              $this->assertSame('1 <', clean_param('1 <', PARAM_TEXT));
              $this->assertSame('x<y', clean_param('x<y', PARAM_TEXT));
              $this->assertSame('x < y', clean_param('x < y', PARAM_TEXT));
       
              $this->assertSame('<lang lang="en">x < y</lang><lang lang="fr">x > y</lang>',
                      clean_param('<lang lang="en">x < y</lang><lang lang="fr">x > y</lang>', PARAM_TEXT));
      

      Some of thost pass, but most fail. I not not sure about the final one. Anyway, it inconsistent that some pass and some fail.

      This was discovered while investigating MDL-49071.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                Unassigned
                Reporter:
                timhunt Tim Hunt
                Participants:
                Component watchers:
                Amaia Anabitarte, Carlos Escobedo, Ferran Recio, Sara Arjona (@sarjona), Víctor Déniz Falcón
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: