General developer forum

The way I see it, Ludo is saying: every time Petr or another expert looks at the code and points out specific errors, we fix them quickly.

However, the way it looks to me: Every time Petr or another expert looks at the code, they immediately see lots of ways where it does not follow the coding guidelines: http://docs.moodle.org/en/Development:Coding - and not just in trivial ways, but in ways that cause potential security problems.

That makes we worried about whether this code should go into Moodle core. The coding guidelines are mostly there for a reason. People writing a large chunk of functionality should not just following the letter of the coding guidelines. They should also understand the underlying principles (which are the general principles of writing secure and robust web applications), and the solutions the Moodle community has adopted for solving them. Then their code will be robust and secure; and understandable and maintainable by others in the community because it follows the same conventions.

Hi!

1/ The problem with blocks is that they are usable only on the course page. They should 'live' on the mod/wiki/view.php page instead. If you place a block on the course page (such as the random glossary) you should be able to specify wiki instance that is linked to it. This would elliminate the need for frontpage wiki format.

2/ Please review again each use of optional_param() and required_param(), these are the most obvious bugs:

formatlib.php - function wiki_main_view_setup() {
optional_param($WS->page, false,PARAM_PATH); // Wiki Page Name
$WS->pagename=stripslashes($WS->pagename);
$WS->pageaction = 'view';
$WS->groupmember->groupid = 0;

format/wiki/format.php
$preferred_width_left = optional_param('preferred_width_left', blocks_preferred_width($pageblocks[BLOCK_POS_LEFT]));
$preferred_width_right = optional_param('preferred_width_right', blocks_preferred_width($pageblocks[BLOCK_POS_RIGHT]));

the use parameter types still does not seem to be optimal - I would recommend documenting all choosing correct input types and then reviewing the use in all code

3/ javascript should not be required - it is one of the accessibility requirements

4/ try to insert single quotes ' and <applet>xxx</applet> everywhere - the start browsing the course, sql errors indicate presence of SQL injections and broken java applet XSS problems. I have discovered one in Navigator and another in Wiki index - I did not try much though.

5/ Warning: Call-time pass-by-reference has been deprecated - argument passed by value; If you would like to pass it by reference, modify the declaration of [runtime function name](). If you would like to enable call-time pass-by-reference, you can set allow_call_time_pass_reference to true in your INI file. However, future versions may not support this any longer. in /home/skodak/workspace/moodle16/mod/wiki/locallib.php on line 387


skodak

But nWiki blocks must be unavailable in other formats

You're right, this one is an item in my neverending TODO list.
A soon as possible I'll fix, there are other items with more priority.

DFWikiTeam, Pigui.