do you really need to use raw $_REQUEST?

schoolyear / moodle-quizaccess_schoolyear

Plugin to integrate the Schoolyear safe exam workspace with the Moodle quiz activity.

0 stars 0 forks source link

do you really need to use raw $_REQUEST? #5

Open danmarsden opened 9 months ago

danmarsden commented 9 months ago

https://github.com/schoolyear/moodle-quizaccess_schoolyear/blob/main/lib.php#L8

can you look to use the moodle api's optional_param or required_param with appropriate cleaning rather than taking the raw unfiltered data from $_REQUEST?

more info here: https://moodledev.io/general/development/policies/security#dont-trust-any-input-from-users