From 0c0a429bff4b552d0990599bb209d2b50b6e6fdf Mon Sep 17 00:00:00 2001
From: Daniel Thies <dthies@gmail.com>
Date: Sun, 14 Apr 2024 16:26:56 -0500
Subject: [PATCH] VID-793: Validate video js file on server

---
 .github/workflows/moodle-ci.yml | 13 ++++---
 classes/vimeo_embed.php         |  5 +++
 mod_form.php                    |  4 +++
 plugin/videojs/lib.php          | 62 ++++++++++++++++++++++-----------
 4 files changed, 59 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/moodle-ci.yml b/.github/workflows/moodle-ci.yml
index 3142f7c1..0fedfb15 100644
--- a/.github/workflows/moodle-ci.yml
+++ b/.github/workflows/moodle-ci.yml
@@ -28,18 +28,21 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - php: '8.1'
+          - php: '8.3'
             moodle-branch: 'master'
             database: 'pgsql'
-          - php: '8.1'
+          - php: '8.2'
             moodle-branch: 'master'
             database: 'mariadb'
+          - php: '8.3'
+            moodle-branch: 'MOODLE_404_STABLE'
+            database: 'pgsql'
+          - php: '8.2'
+            moodle-branch: 'MOODLE_404_STABLE'
+            database: 'mariadb'
           - php: '8.1'
             moodle-branch: 'MOODLE_403_STABLE'
             database: 'pgsql'
-          - php: '8.0'
-            moodle-branch: 'MOODLE_403_STABLE'
-            database: 'mariadb'
           - php: '8.0'
             moodle-branch: 'MOODLE_402_STABLE'
             database: 'pgsql'
diff --git a/classes/vimeo_embed.php b/classes/vimeo_embed.php
index 9a482c32..8e082c8f 100644
--- a/classes/vimeo_embed.php
+++ b/classes/vimeo_embed.php
@@ -51,6 +51,11 @@ class vimeo_embed implements \renderable, \templatable {
      */
     protected $record = null;
 
+    /**
+     * @var $uniqueid Unique id for element
+     */
+    protected $uniqueid = null;
+
     /**
      * Constructor
      *
diff --git a/mod_form.php b/mod_form.php
index 0ab88960..44de5f9b 100644
--- a/mod_form.php
+++ b/mod_form.php
@@ -295,6 +295,10 @@ public function validation($data, $files) {
             }
         }
 
+        foreach (array_keys(core_component::get_plugin_list('videotimeplugin')) as $name) {
+            $errors += component_callback("videotimeplugin_$name", 'validation', [$data, $files], []);
+        }
+
         return $errors;
     }
 
diff --git a/plugin/videojs/lib.php b/plugin/videojs/lib.php
index ff50d904..9aabc666 100644
--- a/plugin/videojs/lib.php
+++ b/plugin/videojs/lib.php
@@ -233,26 +233,6 @@ function videotimeplugin_videojs_add_form_fields($mform, $formclass) {
             $mform->createElement('filemanager', 'mediafile', get_string('mediafile', 'videotimeplugin_videojs'), null, [
                 'subdirs' => 0,
                 'maxfiles' => 1,
-                'accepted_types' => [
-                    '.flac',
-                    '.mp3',
-                    '.mp4',
-                    '.mov',
-                    '.movie',
-                    '.m3u',
-                    '.m3u8',
-                    '.m4a',
-                    '.m4v',
-                    '.mp4',
-                    '.mpeg',
-                    '.ogg',
-                    '.oga',
-                    '.ogv',
-                    '.wav',
-                    '.webm',
-                    '.wma',
-                    '.wmv',
-                ],
             ]),
             'name'
         );
@@ -362,3 +342,45 @@ function videotimeplugin_videojs_config_file_areas() {
         'poster',
     ];
 }
+
+/**
+ * Validates the form input
+ *
+ * @param array $data submitted data
+ * @param array $files submitted files
+ * @return array eventual errors indexed by the field name
+ */
+function videotimeplugin_videojs_validation($data, $files) {
+    $acceptedtypes = [
+        'audio/flac',
+        'audio/mp3',
+        'audio/ogg',
+        'audio/wav',
+        'video/mp4',
+        'video/mpeg',
+        'video/ogg',
+        'video/quicktime',
+        'video/wav',
+        'video/webm',
+    ];
+    if (
+        in_array(resourcelib_guess_url_mimetype($data['vimeo_url']), $acceptedtypes)
+        || mod_videotime_get_vimeo_id_from_link($data['vimeo_url'])
+        || resourcelib_get_extension($data['vimeo_url'] == 'm3u8')
+    ) {
+        return [];
+    }
+    foreach ($files as $file) {
+        if (
+            !$file->is_directory()
+            && ($file->get_itemid() == $data['mediafile'])
+        ) {
+            if (in_array($file->get_mimetype(), $acceptedtypes)) {
+                return [];
+            }
+            return ['mediafile' => get_string('invalidmediafile', 'videotimeplugin_videojs')];
+        }
+
+    }
+    return ['vimeo_url' => get_string('required')];
+}