Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-69431

Validate the 'section' argument passed into /course/modedit.php

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: 3.9.2, 3.10
    • Fix Version/s: 3.9.4, 3.10.1
    • Component/s: Course
    • Labels:

      Description

      When a user adds a new course module to a course using mod chooser, the URL to create the new cm looks like this (in this case adding a book to section 1):

      /course/modedit.php?add=book&type=&course=8&section=1&return=0&sr=0

      The 'section' argument here is expected to be a section number (e.g. the 3rd topic in the course is section number 3) and not a section id (i.e. the id of the section in the course_sections table which could be a very high value).

      At present we do not validate whatever is passed in. So, if the URL includes a very high value (let's say a section id is passed in of 10000, instead of a section number 1) we get undesirable behaviour / create lots of empty sections in course.

      To avoid this we can check whatever is passed in against the course format's get_max_sections() value, and reject any value exceeding it.

      It's a minor security issue in that, without the fix, it seems users are given a route to add new sections in excess of the limits provided.

      Proposed fix attached

        Attachments

          Activity

            People

            Assignee:
            dw8 David Watson
            Reporter:
            dw8 David Watson
            Peer reviewer:
            Ilya Tregubov Ilya Tregubov
            Integrator:
            Jake Dallimore Jake Dallimore
            Tester:
            Janelle Barcega Janelle Barcega
            Participants:
            Component watchers:
            Amaia Anabitarte, Carlos Escobedo, Ferran Recio, Ilya Tregubov, Sara Arjona (@sarjona)
            Votes:
            0 Vote for this issue
            Watchers:
            8 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:
              Fix Release Date:
              18/Jan/21

                Time Tracking

                Estimated:
                Original Estimate - 0 minutes
                0m
                Remaining:
                Remaining Estimate - 0 minutes
                0m
                Logged:
                Time Spent - 56 minutes
                56m