detect_unchecked_vars)) { global $UNCHECKED_VARS; unset ($UNCHECKED_VARS->vars[$parname]); } if (isset($_POST[$parname])) { // POST has precedence $param = $_POST[$parname]; } else if (isset($_GET[$parname])) { $param = $_GET[$parname]; } else { error('A required parameter ('.$parname.') was missing'); } return clean_param($param, $type); } /** * Returns a particular value for the named variable, taken from * POST or GET, otherwise returning a given default. * * This function should be used to initialise all optional values * in a script that are based on parameters. Usually it will be * used like this: * $name = optional_param('name', 'Fred'); * * @param string $parname the name of the page parameter we want * @param mixed $default the default value to return if nothing is found * @param int $type expected type of parameter * @return mixed */ function optional_param($parname, $default=NULL, $type=PARAM_CLEAN) { // detect_unchecked_vars addition global $CFG; if (!empty($CFG->detect_unchecked_vars)) { global $UNCHECKED_VARS; unset ($UNCHECKED_VARS->vars[$parname]); } if (isset($_POST[$parname])) { // POST has precedence $param = $_POST[$parname]; } else if (isset($_GET[$parname])) { $param = $_GET[$parname]; } else { return $default; } return clean_param($param, $type); } /** * Used by {@link optional_param()} and {@link required_param()} to * clean the variables and/or cast to specific types, based on * an options field. * * $course->format = clean_param($course->format, PARAM_ALPHA); * $selectedgrade_item = clean_param($selectedgrade_item, PARAM_CLEAN); * * * @uses $CFG * @uses PARAM_RAW * @uses PARAM_CLEAN * @uses PARAM_CLEANHTML * @uses PARAM_INT * @uses PARAM_NUMBER * @uses PARAM_ALPHA * @uses PARAM_ALPHANUM * @uses PARAM_ALPHAEXT * @uses PARAM_SEQUENCE * @uses PARAM_BOOL * @uses PARAM_NOTAGS * @uses PARAM_TEXT * @uses PARAM_SAFEDIR * @uses PARAM_CLEANFILE * @uses PARAM_FILE * @uses PARAM_PATH * @uses PARAM_HOST * @uses PARAM_URL * @uses PARAM_LOCALURL * @uses PARAM_PEM * @uses PARAM_BASE64 * @uses PARAM_TAG * @uses PARAM_SEQUENCE * @param mixed $param the variable we are cleaning * @param int $type expected format of param after cleaning. * @return mixed */ function clean_param($param, $type) { global $CFG; if (is_array($param)) { // Let's loop $newparam = array(); foreach ($param as $key => $value) { $newparam[$key] = clean_param($value, $type); } return $newparam; } switch ($type) { case PARAM_RAW: // no cleaning at all return $param; case PARAM_CLEAN: // General HTML cleaning, try to use more specific type if possible if (is_numeric($param)) { return $param; } $param = stripslashes($param); // Needed for kses to work fine $param = clean_text($param); // Sweep for scripts, etc return addslashes($param); // Restore original request parameter slashes case PARAM_CLEANHTML: // prepare html fragment for display, do not store it into db!! $param = stripslashes($param); // Remove any slashes $param = clean_text($param); // Sweep for scripts, etc return trim($param); case PARAM_INT: return (int)$param; // Convert to integer case PARAM_NUMBER: return (float)$param; // Convert to integer case PARAM_ALPHA: // Remove everything not a-z return eregi_replace('[^a-zA-Z]', '', $param); case PARAM_ALPHANUM: // Remove everything not a-zA-Z0-9 return eregi_replace('[^A-Za-z0-9]', '', $param); case PARAM_ALPHAEXT: // Remove everything not a-zA-Z/_- return eregi_replace('[^a-zA-Z/_-]', '', $param); case PARAM_SEQUENCE: // Remove everything not 0-9, return eregi_replace('[^0-9,]', '', $param); case PARAM_BOOL: // Convert to 1 or 0 $tempstr = strtolower($param); if ($tempstr == 'on' or $tempstr == 'yes' ) { $param = 1; } else if ($tempstr == 'off' or $tempstr == 'no') { $param = 0; } else { $param = empty($param) ? 0 : 1; } return $param; case PARAM_NOTAGS: // Strip all tags return strip_tags($param); case PARAM_TEXT: // leave only tags needed for multilang return clean_param(strip_tags($param, ''), PARAM_CLEAN); case PARAM_SAFEDIR: // Remove everything not a-zA-Z0-9_- return eregi_replace('[^a-zA-Z0-9_-]', '', $param); case PARAM_CLEANFILE: // allow only safe characters return clean_filename($param); case PARAM_FILE: // Strip all suspicious characters from filename $param = ereg_replace('[[:cntrl:]]|[<>"`\|\':\\/]', '', $param); $param = ereg_replace('\.\.+', '', $param); if($param == '.') { $param = ''; } return $param; case PARAM_PATH: // Strip all suspicious characters from file path $param = str_replace('\\\'', '\'', $param); $param = str_replace('\\"', '"', $param); $param = str_replace('\\', '/', $param); $param = ereg_replace('[[:cntrl:]]|[<>"`\|\':]', '', $param); $param = ereg_replace('\.\.+', '', $param); $param = ereg_replace('//+', '/', $param); return ereg_replace('/(\./)+', '/', $param); case PARAM_HOST: // allow FQDN or IPv4 dotted quad $param = preg_replace('/[^\.\d\w-]/','', $param ); // only allowed chars // match ipv4 dotted quad if (preg_match('/(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/',$param, $match)){ // confirm values are ok if ( $match[0] > 255 || $match[1] > 255 || $match[3] > 255 || $match[4] > 255 ) { // hmmm, what kind of dotted quad is this? $param = ''; } } elseif ( preg_match('/^[\w\d\.-]+$/', $param) // dots, hyphens, numbers && !preg_match('/^[\.-]/', $param) // no leading dots/hyphens && !preg_match('/[\.-]$/', $param) // no trailing dots/hyphens ) { // all is ok - $param is respected } else { // all is not ok... $param=''; } return $param; case PARAM_URL: // allow safe ftp, http, mailto urls include_once($CFG->dirroot . '/lib/validateurlsyntax.php'); if (!empty($param) && validateUrlSyntax($param, 's?H?S?F?E?u-P-a?I?p?f?q?r?')) { // all is ok, param is respected } else { $param =''; // not really ok } return $param; case PARAM_LOCALURL: // allow http absolute, root relative and relative URLs within wwwroot $param = clean_param($param, PARAM_URL); if (!empty($param)) { if (preg_match(':^/:', $param)) { // root-relative, ok! } elseif (preg_match('/^'.preg_quote($CFG->wwwroot, '/').'/i',$param)) { // absolute, and matches our wwwroot } else { // relative - let's make sure there are no tricks if (validateUrlSyntax($param, 's-u-P-a-p-f+q?r?')) { // looks ok. } else { $param = ''; } } } return $param; case PARAM_PEM: $param = trim($param); // PEM formatted strings may contain letters/numbers and the symbols // forward slash: / // plus sign: + // equal sign: = // , surrounded by BEGIN and END CERTIFICATE prefix and suffixes if (preg_match('/^-----BEGIN CERTIFICATE-----([\s\w\/\+=]+)-----END CERTIFICATE-----$/', trim($param), $matches)) { list($wholething, $body) = $matches; unset($wholething, $matches); $b64 = clean_param($body, PARAM_BASE64); if (!empty($b64)) { return "-----BEGIN CERTIFICATE-----\n$b64\n-----END CERTIFICATE-----\n"; } else { return ''; } } return ''; case PARAM_BASE64: if (!empty($param)) { // PEM formatted strings may contain letters/numbers and the symbols // forward slash: / // plus sign: + // equal sign: = if (0 >= preg_match('/^([\s\w\/\+=]+)$/', trim($param))) { return ''; } $lines = preg_split('/[\s]+/', $param, -1, PREG_SPLIT_NO_EMPTY); // Each line of base64 encoded data must be 64 characters in // length, except for the last line which may be less than (or // equal to) 64 characters long. for ($i=0, $j=count($lines); $i < $j; $i++) { if ($i + 1 == $j) { if (64 < strlen($lines[$i])) { return ''; } continue; } if (64 != strlen($lines[$i])) { return ''; } } return implode("\n",$lines); } else { return ''; } case PARAM_TAG: //as long as magic_quotes_gpc is used, a backslash will be a //problem, so remove *all* backslash. $param = str_replace('\\', '', $param); //convert many whitespace chars into one $param = preg_replace('/\s+/', ' ', $param); $textlib = textlib_get_instance(); $param = $textlib->substr(trim($param), 0, TAG_MAX_LENGTH); return $param; case PARAM_TAGLIST: $tags = explode(',', $param); $result = array(); foreach ($tags as $tag) { $res = clean_param($tag, PARAM_TAG); if ($res != '') { $result[] = $res; } } if ($result) { return implode(',', $result); } else { return ''; } default: // throw error, switched parameters in optional_param or another serious problem error("Unknown parameter type: $type"); } } /** * Return true if given value is integer or string with integer value * * @param mixed $value String or Int * @return bool true if number, false if not */ function is_number($value) { if (is_int($value)) { return true; } else if (is_string($value)) { return ((string)(int)$value) === $value; } else { return false; } } /** * This function is useful for testing whether something you got back from * the HTML editor actually contains anything. Sometimes the HTML editor * appear to be empty, but actually you get back a
tag or something. * * @param string $string a string containing HTML. * @return boolean does the string contain any actual content - that is text, * images, objcts, etc. */ function html_is_blank($string) { return trim(strip_tags($string, '