1/ the value is not validated when receiving event creation request from activities
2/ the calendar/event_form.php uses incorrect PARAM_INT on hidden param - the param should not be there at all because users are not allowed to change this type of calendar events
- has been marked as being related by
-
MDL-43918 Denial of service and possible SQL injection in get_coursemodule_from_id() and get_coursemodule_from_instance()
-
- Closed
-