Summary
view.php:36 reads $mode = optional_param('mode', PCAST_STANDARD_VIEW, PARAM_ALPHANUM) (letters allowed) and passes it to standard_action_bar::__construct(..., int $mode, ...). A non-numeric string against a typed int parameter throws TypeError.
Impact
view.php?id=<cm>&mode=abc returns an uncaught TypeError, not a clean error page.
Location
view.php:36 and classes/output/standard_action_bar.php:61
Verified live
GET /mod/pcast/view.php?id=83&mode=abc -> TypeError: ... must be of type int
Suggested fix
Use PARAM_INT for mode; all PCAST_*_VIEW constants are integers.
Verified on a live install: Moodle 5.1.3, PHP 8.2, MariaDB, plugin version 2025121201 (current master). Reproduced 2026-09-02.
Found during the mod_pcast review/test pass (ClickUp 86cb46r9t). Line numbers are against master @ 73bb255.
Summary
view.php:36reads$mode = optional_param('mode', PCAST_STANDARD_VIEW, PARAM_ALPHANUM)(letters allowed) and passes it tostandard_action_bar::__construct(..., int $mode, ...). A non-numeric string against a typedintparameter throwsTypeError.Impact
view.php?id=<cm>&mode=abcreturns an uncaughtTypeError, not a clean error page.Location
view.php:36andclasses/output/standard_action_bar.php:61Verified live
Suggested fix
Use
PARAM_INTformode; allPCAST_*_VIEWconstants are integers.Verified on a live install: Moodle 5.1.3, PHP 8.2, MariaDB, plugin version 2025121201 (current
master). Reproduced 2026-09-02.Found during the mod_pcast review/test pass (ClickUp 86cb46r9t). Line numbers are against
master@ 73bb255.