REPOSITORY MDL-24205, added more check of path and files
[moodle.git] / rating / rate.php
blob3ac00e8915e6c34a9ab65ece40a6466c85788d8c
1 <?php
3 // This file is part of Moodle - http://moodle.org/
4 //
5 // Moodle is free software: you can redistribute it and/or modify
6 // it under the terms of the GNU General Public License as published by
7 // the Free Software Foundation, either version 3 of the License, or
8 // (at your option) any later version.
9 //
10 // Moodle is distributed in the hope that it will be useful,
11 // but WITHOUT ANY WARRANTY; without even the implied warranty of
12 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 // GNU General Public License for more details.
15 // You should have received a copy of the GNU General Public License
16 // along with Moodle. If not, see <http://www.gnu.org/licenses/>.
18 /**
19 * This page receives non-ajax rating submissions
21 * It is similar to rate_ajax.php. Unlike rate_ajax.php a return url is required.
23 * @package core
24 * @subpackage rating
25 * @copyright 2010 Andrew Davis
26 * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
29 require_once('../config.php');
30 require_once('lib.php');
32 $contextid = required_param('contextid', PARAM_INT);
33 $itemid = required_param('itemid', PARAM_INT);
34 $scaleid = required_param('scaleid', PARAM_INT);
35 $userrating = required_param('rating', PARAM_INT);
36 $rateduserid = required_param('rateduserid', PARAM_INT);//which user is being rated. Required to update their grade
37 $returnurl = required_param('returnurl', PARAM_LOCALURL);//required for non-ajax requests
39 $result = new stdClass;
41 list($context, $course, $cm) = get_context_info_array($contextid);
42 require_login($course, false, $cm);
44 $contextid = null;//now we have a context object throw away the id from the user
46 if (!confirm_sesskey() || $USER->id==$rateduserid) {
47 echo $OUTPUT->header();
48 echo get_string('ratepermissiondenied', 'ratings');
49 echo $OUTPUT->footer();
50 die();
53 $rm = new rating_manager();
55 //check the module rating permissions
56 $pluginrateallowed = true;
57 $pluginpermissionsarray = null;
58 if ($context->contextlevel==CONTEXT_MODULE) {
59 $plugintype = 'mod';
60 $pluginname = $cm->modname;
61 $pluginpermissionsarray = $rm->get_plugin_permissions_array($context->id, $plugintype, $pluginname);
62 $pluginrateallowed = $pluginpermissionsarray['rate'];
64 if ($pluginrateallowed) {
65 //check the item exists and isn't owned by the current user
66 $pluginrateallowed = $rm->check_item_and_owner($plugintype, $pluginname, $itemid);
70 if (!$pluginrateallowed || !has_capability('moodle/rating:rate',$context)) {
71 echo $OUTPUT->header();
72 echo get_string('ratepermissiondenied', 'ratings');
73 echo $OUTPUT->footer();
74 die();
77 $PAGE->set_url('/lib/rate.php', array('contextid'=>$context->id));
79 if ($userrating != RATING_UNSET_RATING) {
80 $ratingoptions = new stdclass;
81 $ratingoptions->context = $context;
82 $ratingoptions->itemid = $itemid;
83 $ratingoptions->scaleid = $scaleid;
84 $ratingoptions->userid = $USER->id;
86 $rating = new rating($ratingoptions);
87 $rating->update_rating($userrating);
88 } else { //delete the rating if the user set to Rate...
89 $options = new stdClass();
90 $options->contextid = $context->id;
91 $options->userid = $USER->id;
92 $options->itemid = $itemid;
94 $rm->delete_ratings($options);
97 //todo add a setting to turn grade updating off for those who don't want them in gradebook
98 //note that this needs to be done in both rate.php and rate_ajax.php
99 if(true){
100 //tell the module that its grades have changed
101 if ( !$modinstance = $DB->get_record($cm->modname, array('id' => $cm->instance)) ) {
102 print_error('invalidid');
104 $modinstance->cmidnumber = $cm->id; //MDL-12961
105 $functionname = $cm->modname.'_update_grades';
106 require_once($CFG->dirroot."/mod/{$cm->modname}/lib.php");
107 if(function_exists($functionname)) {
108 $functionname($modinstance, $rateduserid);
112 redirect($returnurl);