|
@@ -1717,6 +1717,15 @@ function api_get_item_visibility($_course,$tool,$id)
|
|
|
*/
|
|
|
function api_item_property_update($_course, $tool, $item_id, $lastedit_type, $user_id, $to_group_id = 0, $to_user_id = NULL, $start_visible = 0, $end_visible = 0)
|
|
|
{
|
|
|
+ $tool = Database::escape_string($tool);
|
|
|
+ $item_id = Database::escape_string($item_id);
|
|
|
+ $lastedit_type = Database::escape_string($lastedit_type);
|
|
|
+ $user_id = Database::escape_string($user_id);
|
|
|
+ $to_group_id = Database::escape_string($to_group_id);
|
|
|
+ $to_user_id = Database::escape_string($to_user_id);
|
|
|
+ $start_visible = Database::escape_string($start_visible);
|
|
|
+ $end_visible = Database::escape_string($end_visible);
|
|
|
+
|
|
|
$time = time();
|
|
|
$time = date("Y-m-d H:i:s", $time);
|
|
|
$TABLE_ITEMPROPERTY = Database :: get_course_table(TABLE_ITEM_PROPERTY,$_course['dbName']);
|
|
@@ -1735,7 +1744,7 @@ function api_item_property_update($_course, $tool, $item_id, $lastedit_type, $us
|
|
|
if (!is_null($to_user_id))
|
|
|
$to_filter = " AND to_user_id='$to_user_id'"; // set filter to intended user
|
|
|
else
|
|
|
- if (!is_null($to_group_id))
|
|
|
+ if (!is_null($to_group_id) and $to_group_id == strval(intval($to_group_id)))
|
|
|
$to_filter = " AND to_group_id='$to_group_id'"; // set filter to intended group
|
|
|
// update if possible
|
|
|
$set_type = "";
|