Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-49077

clean_param($x, PARAM_TEXT) does not work the way users expect regarding < characters

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Duplicate
    • Icon: Minor Minor
    • None
    • 2.8.3
    • Libraries
    • None
    • MOODLE_28_STABLE

      PARAM_TEXT is for multi-lang input. That is, more or less plain text with <lang> or <span> tags.

      What seems to be rather poorly defined is what happens to isolated < signs in the input.

      Users expect to be able to create activities with names like 'x < y', or matching questions with choices like that. And, you can do that, and it works.

      What does not work is if you try to do input like '<' or '<x'. Basically, if the < is not followed by a space, then it gets stripped. That is not what users expect.

      The bad news is that PARAM_TEXT is built on top of the PHP native function strip_tags. That is where the strange behaviour comes from. It is probably good for security, but it is bad for Moodle usability.

      Here are some unit tests. You can past them into the end of test_clean_param_text in lib/tests/moodlelib_test.php

       
              $this->assertSame('<', clean_param('<', PARAM_TEXT));
              $this->assertSame('<3', clean_param('<3', PARAM_TEXT));
              $this->assertSame('< 3', clean_param('< 3', PARAM_TEXT));
              $this->assertSame('1<', clean_param('1<', PARAM_TEXT));
              $this->assertSame('1 <', clean_param('1 <', PARAM_TEXT));
              $this->assertSame('x<y', clean_param('x<y', PARAM_TEXT));
              $this->assertSame('x < y', clean_param('x < y', PARAM_TEXT));
       
              $this->assertSame('<lang lang="en">x < y</lang><lang lang="fr">x > y</lang>',
                      clean_param('<lang lang="en">x < y</lang><lang lang="fr">x > y</lang>', PARAM_TEXT));
      

      Some of thost pass, but most fail. I not not sure about the final one. Anyway, it inconsistent that some pass and some fail.

      This was discovered while investigating MDL-49071.

            Unassigned Unassigned
            timhunt Tim Hunt
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved:

                Error rendering 'clockify-timesheets-time-tracking-reports:timer-sidebar'. Please contact your Jira administrators.