[svn r15055] Added filtering to api_item_property_update(). Filtering should always happen at the closest level to the database.

main/inc/lib/main_api.lib.php

@@ -1717,6 +1717,15 @@ function api_get_item_visibility($_course,$tool,$id)
  */
 function api_item_property_update($_course, $tool, $item_id, $lastedit_type, $user_id, $to_group_id = 0, $to_user_id = NULL, $start_visible = 0, $end_visible = 0)
 {
+	$tool = Database::escape_string($tool);
+	$item_id = Database::escape_string($item_id);
+	$lastedit_type = Database::escape_string($lastedit_type);
+	$user_id = Database::escape_string($user_id);
+	$to_group_id = Database::escape_string($to_group_id);
+	$to_user_id = Database::escape_string($to_user_id);
+	$start_visible = Database::escape_string($start_visible);
+	$end_visible = Database::escape_string($end_visible);
+
 	$time = time();
 	$time = date("Y-m-d H:i:s", $time);
 	$TABLE_ITEMPROPERTY = Database :: get_course_table(TABLE_ITEM_PROPERTY,$_course['dbName']);
@@ -1735,7 +1744,7 @@ function api_item_property_update($_course, $tool, $item_id, $lastedit_type, $us
 	if (!is_null($to_user_id))
 		$to_filter = " AND to_user_id='$to_user_id'"; // set filter to intended user
 	else
-		if (!is_null($to_group_id))
+		if (!is_null($to_group_id) and $to_group_id == strval(intval($to_group_id)))
 			$to_filter = " AND to_group_id='$to_group_id'"; // set filter to intended group
 	// update if possible
 	$set_type = "";