-
Bug
-
Resolution: Duplicate
-
Minor
-
None
-
2.8.3
-
None
-
MOODLE_28_STABLE
PARAM_TEXT is for multi-lang input. That is, more or less plain text with <lang> or <span> tags.
What seems to be rather poorly defined is what happens to isolated < signs in the input.
Users expect to be able to create activities with names like 'x < y', or matching questions with choices like that. And, you can do that, and it works.
What does not work is if you try to do input like '<' or '<x'. Basically, if the < is not followed by a space, then it gets stripped. That is not what users expect.
The bad news is that PARAM_TEXT is built on top of the PHP native function strip_tags. That is where the strange behaviour comes from. It is probably good for security, but it is bad for Moodle usability.
Here are some unit tests. You can past them into the end of test_clean_param_text in lib/tests/moodlelib_test.php
|
$this->assertSame('<', clean_param('<', PARAM_TEXT)); |
$this->assertSame('<3', clean_param('<3', PARAM_TEXT)); |
$this->assertSame('< 3', clean_param('< 3', PARAM_TEXT)); |
$this->assertSame('1<', clean_param('1<', PARAM_TEXT)); |
$this->assertSame('1 <', clean_param('1 <', PARAM_TEXT)); |
$this->assertSame('x<y', clean_param('x<y', PARAM_TEXT)); |
$this->assertSame('x < y', clean_param('x < y', PARAM_TEXT)); |
|
$this->assertSame('<lang lang="en">x < y</lang><lang lang="fr">x > y</lang>', |
clean_param('<lang lang="en">x < y</lang><lang lang="fr">x > y</lang>', PARAM_TEXT)); |
Some of thost pass, but most fail. I not not sure about the final one. Anyway, it inconsistent that some pass and some fail.
This was discovered while investigating MDL-49071.