|
@@ -34,16 +34,20 @@ require_once ('resourcelinker.inc.php');
|
|
|
require_once ('../inc/lib/tracking.lib.php');
|
|
|
require_once ('../inc/lib/course.lib.php');
|
|
|
|
|
|
-
|
|
|
if(empty($_SESSION['_course']['id']) && isset($_GET['course']))
|
|
|
{
|
|
|
- $course_code = Database :: escape_string($_GET['course']);
|
|
|
+ $course_code = Security::remove_XSS($_GET['course']);
|
|
|
}
|
|
|
else
|
|
|
{
|
|
|
$course_code = $_SESSION['_course']['id'];
|
|
|
}
|
|
|
|
|
|
+
|
|
|
+if (isset($_GET['student_id'])) {
|
|
|
+ $student_id = intval($_GET['student_id']);
|
|
|
+}
|
|
|
+
|
|
|
//The two following variables have to be declared by the includer script
|
|
|
//$lp_id = $_SESSION['oLP']->get_id();
|
|
|
//$list = $_SESSION['oLP']->get_flat_ordered_items_list($lp_id);
|
|
@@ -100,7 +104,7 @@ $extend_all_link = '';
|
|
|
$extend_all = 0;
|
|
|
|
|
|
if ($origin == 'tracking') {
|
|
|
- $url_suffix = '&course=' . $_GET['course'] . '&student_id=' . $_GET['student_id'] . '&lp_id=' . $_GET['lp_id'] . '&origin=' . $_GET['origin'];
|
|
|
+ $url_suffix = '&course=' . Security::remove_XSS($_GET['course']) . '&student_id=' . $student_id . '&lp_id=' . Security::remove_XSS($_GET['lp_id']) . '&origin=' . Security::remove_XSS($_GET['origin']);
|
|
|
} else {
|
|
|
$url_suffix = '';
|
|
|
}
|
|
@@ -164,7 +168,7 @@ if (isset($_GET['lp_id']) && isset($_GET['my_lp_id'])) {
|
|
|
if ($origin != 'tracking') {
|
|
|
$sql_attempts = 'SELECT * FROM ' . $tbl_stats_exercices . ' WHERE exe_exo_id="' . (int)$row_path['path'] . '" AND exe_user_id="' . (int)api_get_user_id() . '" AND orig_lp_id = "'.(int)$clean_lp_id.'" AND orig_lp_item_id = "'.(int)$clean_lp_item_id.'" AND exe_cours_id="' . $clean_course_code. '" AND status <> "incomplete" ORDER BY exe_date';
|
|
|
} else {
|
|
|
- $sql_attempts = 'SELECT * FROM ' . $tbl_stats_exercices . ' WHERE exe_exo_id="' . (int)$row_path['path'] . '" AND exe_user_id="' . (int)$_GET['student_id'] . '" AND orig_lp_id = "'.(int)$clean_lp_id.'" AND orig_lp_item_id = "'.(int)$clean_lp_item_id.'" AND exe_cours_id="' . $clean_course_code. '" AND status <> "incomplete" ORDER BY exe_date';
|
|
|
+ $sql_attempts = 'SELECT * FROM ' . $tbl_stats_exercices . ' WHERE exe_exo_id="' . (int)$row_path['path'] . '" AND exe_user_id="' . $student_id . '" AND orig_lp_id = "'.(int)$clean_lp_id.'" AND orig_lp_item_id = "'.(int)$clean_lp_item_id.'" AND exe_cours_id="' . $clean_course_code. '" AND status <> "incomplete" ORDER BY exe_date';
|
|
|
}
|
|
|
}
|
|
|
|
|
@@ -456,7 +460,7 @@ if (is_array($list) && count($list) > 0){
|
|
|
if ($origin != 'tracking') {
|
|
|
$sql_last_attempt = 'SELECT * FROM ' . $tbl_stats_exercices . ' WHERE exe_exo_id="' . $row['path'] . '" AND exe_user_id="' . api_get_user_id() . '" AND orig_lp_id = "'.$lp_id.'" AND orig_lp_item_id = "'.$row['myid'].'" AND exe_cours_id="' . $course_code . '" AND status <> "incomplete" ORDER BY exe_date DESC limit 1';
|
|
|
} else {
|
|
|
- $sql_last_attempt = 'SELECT * FROM ' . $tbl_stats_exercices . ' WHERE exe_exo_id="' . $row['path'] . '" AND exe_user_id="' . $_GET['student_id'] . '" AND orig_lp_id = "'.$lp_id.'" AND orig_lp_item_id = "'.$row['myid'].'" AND exe_cours_id="' . $course_code . '" AND status <> "incomplete" ORDER BY exe_date DESC limit 1';
|
|
|
+ $sql_last_attempt = 'SELECT * FROM ' . $tbl_stats_exercices . ' WHERE exe_exo_id="' . $row['path'] . '" AND exe_user_id="' . $student_id . '" AND orig_lp_id = "'.$lp_id.'" AND orig_lp_item_id = "'.$row['myid'].'" AND exe_cours_id="' . $course_code . '" AND status <> "incomplete" ORDER BY exe_date DESC limit 1';
|
|
|
}
|
|
|
|
|
|
$resultLastAttempt = api_sql_query($sql_last_attempt, __FILE__, __LINE__);
|
|
@@ -553,8 +557,8 @@ if (is_array($list) && count($list) > 0){
|
|
|
$my_url_suffix = '&course=' . api_get_course_id() . '&student_id=' . api_get_user_id() . '&lp_id=' . Security::remove_XSS($row['mylpid']);
|
|
|
$sql_last_attempt = 'SELECT * FROM ' . $tbl_stats_exercices . ' WHERE exe_exo_id="' . $row['path'] . '" AND exe_user_id="' . api_get_user_id() . '" AND orig_lp_id = "'.$lp_id.'" AND orig_lp_item_id = "'.$row['myid'].'" AND exe_cours_id="' . $course_code . '" AND status <> "incomplete" ORDER BY exe_date DESC ';
|
|
|
} else {
|
|
|
- $my_url_suffix = '&course=' . $_GET['course'] . '&student_id=' . Security::remove_XSS($_GET['student_id']) . '&lp_id=' . Security::remove_XSS($row['mylpid']).'&origin=' . Security::remove_XSS($_GET['origin']);
|
|
|
- $sql_last_attempt = 'SELECT * FROM ' . $tbl_stats_exercices . ' WHERE exe_exo_id="' . $row['path'] . '" AND exe_user_id="' . Database :: escape_string($_GET['student_id']) . '" AND orig_lp_id = "'.$lp_id.'" AND orig_lp_item_id = "'.$row['myid'].'" AND exe_cours_id="' . Database :: escape_string($_GET['course']) . '" AND status <> "incomplete" ORDER BY exe_date DESC ';
|
|
|
+ $my_url_suffix = '&course=' . Security::remove_XSS($_GET['course']) . '&student_id=' . $student_id . '&lp_id=' . Security::remove_XSS($row['mylpid']).'&origin=' . Security::remove_XSS($_GET['origin']);
|
|
|
+ $sql_last_attempt = 'SELECT * FROM ' . $tbl_stats_exercices . ' WHERE exe_exo_id="' . $row['path'] . '" AND exe_user_id="' . $student_id . '" AND orig_lp_id = "'.$lp_id.'" AND orig_lp_item_id = "'.$row['myid'].'" AND exe_cours_id="' . Database :: escape_string($_GET['course']) . '" AND status <> "incomplete" ORDER BY exe_date DESC ';
|
|
|
}
|
|
|
|
|
|
$resultLastAttempt = api_sql_query($sql_last_attempt, __FILE__, __LINE__);
|
|
@@ -700,14 +704,14 @@ if (is_array($list) && count($list) > 0){
|
|
|
if (!api_is_allowed_to_edit() && $result_disabled_ext_all) {
|
|
|
$output .= '<td><img src="' . api_get_path(WEB_IMG_PATH) . 'quiz_na.gif" alt="'.get_lang('ShowAttempt').'" title="'.get_lang('ShowAttempt').'"></td>';
|
|
|
} else {
|
|
|
- $output .= '<td><a href="../exercice/exercise_show.php?origin=student_progress&myid='.$my_orig_lp.'&my_lp_id='.$my_orig_lp_item.'&id=' . $my_exe_id . '&cidReq=' . $course_code . '&student=' . $_GET['student_id'] . '" target="_parent"><img src="' . api_get_path(WEB_IMG_PATH) . 'quiz.gif" alt="'.get_lang('ShowAttempt').'" title="'.get_lang('ShowAttempt').'"></a></td>';
|
|
|
+ $output .= '<td><a href="../exercice/exercise_show.php?origin=student_progress&myid='.$my_orig_lp.'&my_lp_id='.$my_orig_lp_item.'&id=' . $my_exe_id . '&cidReq=' . $course_code . '&student=' . $student_id . '" target="_parent"><img src="' . api_get_path(WEB_IMG_PATH) . 'quiz.gif" alt="'.get_lang('ShowAttempt').'" title="'.get_lang('ShowAttempt').'"></a></td>';
|
|
|
}
|
|
|
|
|
|
} else {
|
|
|
if (!api_is_allowed_to_edit() && $result_disabled_ext_all) {
|
|
|
$output .= '<td><img src="' . api_get_path(WEB_IMG_PATH) . 'quiz_na.gif" alt="'.get_lang('ShowAndQualifyAttempt').'" title="'.get_lang('ShowAndQualifyAttempt').'"></td>';
|
|
|
} else {
|
|
|
- $output .= '<td><a href="../exercice/exercise_show.php?origin=tracking_course&myid='.$my_orig_lp.'&my_lp_id='.$my_orig_lp_item.'&id=' . $my_exe_id . '&cidReq=' . $course_code . '&student=' . $_GET['student_id'] . '&total_time='.$mytime.'&my_exe_exo_id='.$my_exo_exe_id.' " target="_parent"><img src="' . api_get_path(WEB_IMG_PATH) . 'quiz.gif" alt="'.get_lang('ShowAndQualifyAttempt').'" title="'.get_lang('ShowAndQualifyAttempt').'"></a></td>';
|
|
|
+ $output .= '<td><a href="../exercice/exercise_show.php?origin=tracking_course&myid='.$my_orig_lp.'&my_lp_id='.$my_orig_lp_item.'&id=' . $my_exe_id . '&cidReq=' . $course_code . '&student=' . $student_id . '&total_time='.$mytime.'&my_exe_exo_id='.$my_exo_exe_id.' " target="_parent"><img src="' . api_get_path(WEB_IMG_PATH) . 'quiz.gif" alt="'.get_lang('ShowAndQualifyAttempt').'" title="'.get_lang('ShowAndQualifyAttempt').'"></a></td>';
|
|
|
}
|
|
|
}
|
|
|
$output .= '</tr>';
|
|
@@ -732,7 +736,7 @@ if (!empty($a_my_id)) {
|
|
|
$my_studen_id = 0;
|
|
|
$my_course_id = '';
|
|
|
if ($origin == 'tracking') {
|
|
|
- $my_studen_id = intval($_GET['student_id']);
|
|
|
+ $my_studen_id = $student_id;
|
|
|
$my_course_id = Database::escape_string($_GET['course']);
|
|
|
} else {
|
|
|
$my_studen_id = intval(api_get_user_id());
|