From a6e465b7a36e9ccadfda6aed9ff59a111bcb28fb Mon Sep 17 00:00:00 2001
From: Waleed Hassan <waleed.hassan@catalyst-eu.net>
Date: Sun, 12 Jul 2026 23:45:42 +0100
Subject: [PATCH] WR #490867 auth_outage Review changes - avoid mutating
 svgicons before a redirect and update tests for the access key and svgicons
 changes

---
 classes/local/controllers/infopage.php    | 10 ++++++----
 tests/local/controllers/infopage_test.php | 16 ++++++++++++----
 tests/local/outagelib_test.php            |  8 ++++----
 3 files changed, 22 insertions(+), 12 deletions(-)

diff --git a/classes/local/controllers/infopage.php b/classes/local/controllers/infopage.php
index b4d9548..0e7cded 100644
--- a/classes/local/controllers/infopage.php
+++ b/classes/local/controllers/infopage.php
@@ -87,10 +87,6 @@ class infopage {
      */
     public function output() {
         global $PAGE, $CFG, $OUTPUT;
-        // Enable SVG support here to make sure all SVG files
-        // used in the current theme are served properly.
-        $previoussvg = $CFG->svgicons ?? null;
-        $CFG->svgicons = true;
 
         if (is_null($this->outage)) {
             redirect(new moodle_url('/'));
@@ -100,6 +96,12 @@ class infopage {
         if (!$this->static && !has_capability('auth/outage:viewinfo', context_system::instance())) {
             redirect(new moodle_url('/'));
         }
+
+        // Enable SVG support here to make sure all SVG files
+        // used in the current theme are served properly.
+        $previoussvg = $CFG->svgicons ?? null;
+        $CFG->svgicons = true;
+
         $PAGE->set_context(context_system::instance());
         $PAGE->set_title($this->outage->get_title());
         $PAGE->set_heading($this->outage->get_title());
diff --git a/tests/local/controllers/infopage_test.php b/tests/local/controllers/infopage_test.php
index badb315..31e0d2a 100644
--- a/tests/local/controllers/infopage_test.php
+++ b/tests/local/controllers/infopage_test.php
@@ -154,15 +154,23 @@ final class infopage_test extends \auth_outage\base_testcase {
     }
 
     /**
-     * Tests the constructor enables SVG support.
+     * Tests that rendering the page enables SVG support and restores the previous value afterwards.
      */
-    public function test_svgicons_is_true(): void {
+    public function test_svgicons_is_restored_after_output(): void {
         global $CFG;
 
         $this->assertTrue(has_capability('auth/outage:viewinfo', context_system::instance()));
 
+        $outage = $this->get_dummy_outage();
         $CFG->svgicons = false;
-        new infopage();
-        self::assertTrue($CFG->svgicons);
+
+        $info = new infopage(['outage' => $outage, 'static' => false]);
+        // Constructing the page should not touch $CFG->svgicons.
+        self::assertFalse($CFG->svgicons);
+
+        $info->get_output();
+
+        // Svgicons should be restored to its original value once rendering has finished.
+        self::assertFalse($CFG->svgicons);
     }
 }
diff --git a/tests/local/outagelib_test.php b/tests/local/outagelib_test.php
index 49e38a6..c45a95c 100644
--- a/tests/local/outagelib_test.php
+++ b/tests/local/outagelib_test.php
@@ -272,7 +272,7 @@ if ((time() >= 123) && (time() < 456)) {
         require_once($CFG->dirroot.'/lib/classes/ip_utils.php');
     }
     // Put access key as a cookie if given. This stops the need to put it as a url param on every request.
-    $urlaccesskey = optional_param('accesskey', null, PARAM_TEXT);
+    $urlaccesskey = optional_param('accesskey', null, PARAM_ALPHANUM);
     $isphpunit = defined('PHPUNIT_TEST');
 
     if (!empty($urlaccesskey) && !$isphpunit) {
@@ -318,7 +318,7 @@ e.e.e.e/20');
         }
 
         if (true && $accesskeyblocked) {
-            echo '<!-- auth_outage blocked by missing or incorrect access key, access key given: '. $useraccesskey .' -->';
+            echo '<!-- auth_outage blocked by missing or incorrect access key, access key given: ' . htmlspecialchars($useraccesskey ?? '', ENT_QUOTES | ENT_HTML5, 'UTF-8') . ' -->';
         }
 
         if (!$isphpunit) {
@@ -358,7 +358,7 @@ if ((time() >= 123) && (time() < 456)) {
         require_once($CFG->dirroot.'/lib/classes/ip_utils.php');
     }
     // Put access key as a cookie if given. This stops the need to put it as a url param on every request.
-    $urlaccesskey = optional_param('accesskey', null, PARAM_TEXT);
+    $urlaccesskey = optional_param('accesskey', null, PARAM_ALPHANUM);
     $isphpunit = defined('PHPUNIT_TEST');
 
     if (!empty($urlaccesskey) && !$isphpunit) {
@@ -402,7 +402,7 @@ if ((time() >= 123) && (time() < 456)) {
         }
 
         if (true && $accesskeyblocked) {
-            echo '<!-- auth_outage blocked by missing or incorrect access key, access key given: '. $useraccesskey .' -->';
+            echo '<!-- auth_outage blocked by missing or incorrect access key, access key given: ' . htmlspecialchars($useraccesskey ?? '', ENT_QUOTES | ENT_HTML5, 'UTF-8') . ' -->';
         }
 
         if (!$isphpunit) {