Skip to content

Commit

Permalink
MDL-30480 fix BC regression from MDL-29033
Browse files Browse the repository at this point in the history
Improve insert_record() and update_record() handling of $dataobject parameter. Some developers expect they can use any class instance there. This is not officially supported, but in any case we should not break backwards compatibility so late in STABLE branch.

Credit for discovery goes to Pascal Maury, thanks!
  • Loading branch information
skodak committed Nov 29, 2011
1 parent 8bcfa47 commit 33314c7
Showing 1 changed file with 16 additions and 0 deletions.
16 changes: 16 additions & 0 deletions lib/dmllib.php
Expand Up @@ -1448,6 +1448,14 @@ function insert_record($table, $dataobject, $returnid=true, $primarykey='id') {
if (is_array($dataobject)) {
debugging('Warning. Wrong call to insert_record(). $dataobject must be an object. array found instead', DEBUG_DEVELOPER);
$dataobject = (object)$dataobject;
} else if (is_object($dataobject)) {
// make sure there are no properties or private methods because we cast to array later,
// at the same time this undos the object references so that PHP 5 works the same as PHP 4,
// the main reason for this is BC after the dirty magic hack introduction
if ($properties = get_object_vars($dataobject)) {
$dataobject = (object)$properties;
}
unset($properties);
}

/// Temporary hack as part of phasing out all access to obsolete user tables XXX
Expand Down Expand Up @@ -1643,6 +1651,14 @@ function update_record($table, $dataobject) {
if (is_array($dataobject)) {
debugging('Warning. Wrong call to update_record(). $dataobject must be an object. array found instead', DEBUG_DEVELOPER);
$dataobject = (object)$dataobject;
} else if (is_object($dataobject)) {
// make sure there are no properties or private methods because we cast to array later,
// at the same time this undos the object references so that PHP 5 works the same as PHP 4,
// the main reason for this is BC after the dirty magic hack introduction
if ($properties = get_object_vars($dataobject)) {
$dataobject = (object)$properties;
}
unset($properties);
}

/// Extra protection against SQL injections
Expand Down

0 comments on commit 33314c7

Please sign in to comment.