Mahara

Fix user input from direct get post usage

Series 17.04
Bug #1732987

Bug #1732987 reported by Robert Lyon on 2017-11-17

256

This bug affects 1 person

	Status	Importance	Assigned to	Milestone
Mahara	Fix Released	High	Unassigned	Mahara 18.04.0
16.10	Fix Released	High	Unassigned	Mahara 16.10.7
17.04	Fix Released	High	Unassigned	Mahara 17.04.5
17.10	Fix Released	High	Unassigned	Mahara 17.10.2
18.04	Fix Released	High	Unassigned	Mahara 18.04.0

Bug Description

Makes sure the data is using valid utf8, invalid characters are discarded
- avoid null chars and invalid unicode

Also change direct $_GET and $_POST calls
eg change
isset($_POST['myparam']) to param_exists('myparam')
$_POST['myparam'] = 'cats' to param_alpha('myparam', null)
etc