Commit 5c16db4f authored by Damyon Wiese's avatar Damyon Wiese Committed by Dan Poltawski
Browse files

MDL-51569 mod_choice: Validate the submitted optionid

Make sure any submitted choice options actually belong to the current choice
module.
parent 720d8877
......@@ -265,6 +265,12 @@ function choice_user_submit_response($formanswer, $choice, $userid, $course, $cm
$formanswers = array($formanswer);
}
$options = $DB->get_records('choice_options', array('choiceid' => $choice->id), '', 'id');
foreach ($formanswers as $key => $val) {
if (!isset($options[$val])) {
print_error('cannotsubmit', 'choice', $continueurl);
}
}
// Start lock to prevent synchronous access to the same data
// before it's updated, if using limits.
if ($choice->limitanswers) {
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment