add validation for grade category

Author: TamaroWalter

lib.php

@@ -86,6 +86,25 @@
 
 /* Moodle core API */
 
+/**
+ * Ensure the given grade category id belongs to the course. Return valid id or null.
+ *
+ * @param int|null $courseid
+ * @param int|null $gradecatid
+ * @return int|null
+ */
+function moodleoverflow_validate_grade_category(?int $courseid, ?int $gradecatid): ?int {
+    global $DB;
+    if (empty($courseid) || empty($gradecatid)) {
+        return null;
+    }
+    $category = $DB->get_record('grade_categories', ['id' => $gradecatid]);
+    if ($category && $category->courseid == $courseid) {
+        return $category->id;
+    }
+    return null;
+}
+
 /**
  * Returns the information on whether the module supports a feature.
  *
@@ -137,9 +156,17 @@ function moodleoverflow_add_instance(stdClass $moodleoverflow, ?mod_moodleoverfl
     // Set the current time.
     $moodleoverflow->timecreated = time();
 
-    // You may have to add extra stuff in here.
+    // Sanitize grade category before storing to avoid cross-course references.
+    if (property_exists($moodleoverflow, 'gradecat')) {
+        $moodleoverflow->gradecat = moodleoverflow_validate_grade_category($moodleoverflow->course, $moodleoverflow->gradecat);
+    }
+
+    // Insert the record.
     $moodleoverflow->id = $DB->insert_record('moodleoverflow', $moodleoverflow);
 
+    // Create the grade item with the sanitized category.
+    moodleoverflow_grade_item_update($moodleoverflow);
+
     return $moodleoverflow->id;
 }
 
@@ -150,7 +177,7 @@ function moodleoverflow_add_instance(stdClass $moodleoverflow, ?mod_moodleoverfl
  * @param object   $context        The context of the moodleoverflow
  * @param stdClass $moodleoverflow The moodleoverflow object
  */
-function moodleoverflow_instance_created($context, $moodleoverflow) {
+function moodleoverflow_instance_created(context_module $context, $moodleoverflow) {
 
     // Check if users are forced to be subscribed to the moodleoverflow instance.
     if ($moodleoverflow->forcesubscribe == MOODLEOVERFLOW_INITIALSUBSCRIBE) {
@@ -204,6 +231,11 @@ function moodleoverflow_update_instance(stdClass $moodleoverflow, ?mod_moodleove
         }
     }
 
+    // Sanitize grade category before saving to avoid cross-course references.
+    if (property_exists($moodleoverflow, 'gradecat')) {
+        $moodleoverflow->gradecat = moodleoverflow_validate_grade_category((int)$moodleoverflow->course, $moodleoverflow->gradecat);
+    }
+
     // Update the moodleoverflow instance in the database.
     $result = $DB->update_record('moodleoverflow', $moodleoverflow);
 
@@ -455,6 +487,7 @@ function moodleoverflow_pluginfile($course, $cm, $context, $filearea, $args, $fo
 
     // Finally send the file.
     send_stored_file($file, 86400, 0, true, $options); // Download MUST be forced - security!
+    return true;
 }
 
 /* Navigation API */
@@ -696,7 +729,7 @@ function moodleoverflow_update_grades($moodleoverflow, $userid, $nullifnone = nu
  * @return int grade_update function success code
  */
 function moodleoverflow_grade_item_update($moodleoverflow, $grades = null) {
-    global $CFG, $DB;
+    global $CFG;
 
     if (!function_exists('grade_update')) { // Workaround for buggy PHP versions.
         require_once($CFG->libdir . '/gradelib.php');
@@ -712,6 +745,14 @@ function moodleoverflow_grade_item_update($moodleoverflow, $grades = null) {
         $params['grademin'] = 0;
     }
 
+    // Only include a category that belongs to this course.
+    if (property_exists($moodleoverflow, 'gradecat')) {
+        $validcat = moodleoverflow_validate_grade_category((int)$moodleoverflow->course, $moodleoverflow->gradecat);
+        if ($validcat !== null) {
+            $params['categoryid'] = $validcat;
+        }
+    }
+
     if ($grades === 'reset') {
         $params['reset'] = true;
         $grades = null;
@@ -728,12 +769,6 @@ function moodleoverflow_grade_item_update($moodleoverflow, $grades = null) {
         $params
     );
 
-    // Modify grade item category id.
-    if (!is_null($moodleoverflow->gradecat) && $moodleoverflow->gradecat > 0) {
-        $params = ['itemname' => $moodleoverflow->name, 'idnumber' => $moodleoverflow->id];
-        $DB->set_field('grade_items', 'categoryid', $moodleoverflow->gradecat, $params);
-    }
-
     return $gradeupdate;
 }