search

ecampbell / moodle-atto_wordimport

Import Word file contents into Moodle Atto text box
2 stars 7 forks source link

Dangerous operations in xmldb_atto_wordimport_uninstall() #10

Closed mudrd8mz closed 8 years ago

mudrd8mz commented 8 years ago

Such a blind usage of str_replace() in xmldb_atto_wordimport_uninstall() is dangerous. Imagine that someone has yet another atto plugin called wordimport2 or swordimporter installed.

I would recommend not to touch the Atto toolbar setting in neither xmldb_atto_wordimport_uninstall nor xmldb_atto_wordimport_install and let it up to the admin to configure things themselves.

If you really insist on removing your plugin from the atto toolbar config, you must do it properly via exploding the values there, not via str_replace().

ecampbell commented 8 years ago

explode/implode used instead of str_replace