WR490974: Recommended amendments

Author: Alex Priestley

callback.php

@@ -149,7 +149,7 @@
         }
 
         $divicon = html_writer::tag('div', $icon, ['id' => 'icon' . $cat->catid]);
-        $title = html_writer::tag('strong', $cat->catname);
+        $title = html_writer::tag('strong', format_string($cat->catname));
         $rawsize = $excludebackups ? $cat->filesize - $cat->backupsize : $cat->filesize;
         $filesize = report_coursesize_displaysize($rawsize, $displaysize);
         $size = html_writer::tag('strong', $filesize);
@@ -246,7 +246,7 @@
 
         $title = html_writer::link(
             $CFG->wwwroot . '/course/view.php?id=' . $course->courseid,
-            $course->coursename
+            format_string($course->coursename)
         );
 
         $backupinfo = 'Backup size: ' . format_float($course->backupsize ?? 0, 0) . ' bytes';

classes/local/helper.php

@@ -43,9 +43,9 @@ public static function get_options(): array {
         $displaysizedefault = 'auto';
         $excludebackupsdefault = 0;
 
-        $sortorder = optional_param('sorder', $sortorderdefault, PARAM_TEXT);
-        $sortdir = optional_param('sdir', $sortdirdefault, PARAM_TEXT);
-        $displaysize = optional_param('display', $displaysizedefault, PARAM_TEXT);
+        $sortorder = optional_param('sorder', $sortorderdefault, PARAM_ALPHA);
+        $sortdir = optional_param('sdir', $sortdirdefault, PARAM_ALPHA);
+        $displaysize = optional_param('display', $displaysizedefault, PARAM_ALPHA);
         $excludebackups = optional_param('excludebackups', $excludebackupsdefault, PARAM_INT);
 
         // Display options.

db/access.php

@@ -28,7 +28,7 @@
 
     /* allows the user to view the site's data usage summary */
     'report/coursesize:view' => [
-        'riskbitmask' => RISK_CONFIG,
+        'riskbitmask' => RISK_PERSONAL | RISK_CONFIG,
         'captype' => 'read',
         'contextlevel' => CONTEXT_SYSTEM,
         'archetypes' => [

granular.php

@@ -64,7 +64,7 @@
     $table->data = [];
 
     foreach ($filelist as $fileinfo) {
-        $filename = $fileinfo->filename;
+        $filename = s($fileinfo->filename);
 
         if ($dohtml) {
             // Soft-break long lines on underscores with a zero-width space.
@@ -76,6 +76,7 @@
         if (str_contains($fileinfo->filename, '.')) {
             $parts = explode('.', $fileinfo->filename);
             $ext = end($parts);
+            $ext = s($ext);
         }
 
         $username = $DB->get_field('user', 'username', ['id' => $fileinfo->userid]);

locallib.php

@@ -853,7 +853,7 @@ function report_coursesize_export($displaysize, $sortorder, $sortdir) {
     $sql .= ' ORDER BY ' . $orderby;
 
     if ($cats = $DB->get_records_sql($sql, $params)) {
-        if ($config->calcmethod == 'live') {
+        if (isset($config->calcmethod) && $config->calcmethod == 'live') {
             // Recalculate.
             $dosort = false;
             foreach ($cats as $cat) {
@@ -934,7 +934,7 @@ function report_coursesize_export($displaysize, $sortorder, $sortdir) {
     $categories[0] = '/';
 
     if ($courses = $DB->get_records_sql($sql, $params)) {
-        if ($config->calcmethod == 'live') {
+        if (isset($config->calcmethod) && $config->calcmethod == 'live') {
             // Recalculate.
             $dosort = false;
             foreach ($courses as $course) {

version.php

@@ -24,9 +24,9 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$plugin->version  = 2025121001;
+$plugin->version  = 2025121002;
 $plugin->requires = 2022112800; // Requires 4.1.
 $plugin->component = 'report_coursesize';
-$plugin->release  = 2024112602;
+$plugin->release  = 2025121001;
 $plugin->maturity  = MATURITY_STABLE;
 $plugin->supported = [401, 405];