Summary
In pcast_reset_userdata(), the "episodes by users not enrolled" branch builds $unenrolledepisodessql that returns pcast_episodes.id, then calls get_coursemodule_from_instance('pcast', $pcastid) treating each episode id as a podcast instance id and delete_area_files(..., 'episode') on the result.
Impact
Files and ratings are deleted from whichever podcast instance happens to share an id with an episode - potentially wiping all media of an unrelated podcast in the same course.
Location
lib.php:1143-1151
Note
The reset_pcast_all path itself is fine - it does not throw on extra query params (fix_sql_params only errors on too few). Verified live: reset_pcast_all ran clean, episodes before = 2, after = 0.
Suggested fix
Use the podcast-instance subquery ($allpcastssql) as the reset_pcast_all branch does, not the episode-id subquery.
Verified on a live install: Moodle 5.1.3, PHP 8.2, MariaDB, plugin version 2025121201 (current master). Reproduced 2026-09-02.
Found during the mod_pcast review/test pass (ClickUp 86cb46r9t). Line numbers are against master @ 73bb255.
Summary
In
pcast_reset_userdata(), the "episodes by users not enrolled" branch builds$unenrolledepisodessqlthat returnspcast_episodes.id, then callsget_coursemodule_from_instance('pcast', $pcastid)treating each episode id as a podcast instance id anddelete_area_files(..., 'episode')on the result.Impact
Files and ratings are deleted from whichever podcast instance happens to share an id with an episode - potentially wiping all media of an unrelated podcast in the same course.
Location
lib.php:1143-1151Note
The
reset_pcast_allpath itself is fine - it does not throw on extra query params (fix_sql_paramsonly errors on too few). Verified live:reset_pcast_allran clean, episodes before = 2, after = 0.Suggested fix
Use the podcast-instance subquery (
$allpcastssql) as thereset_pcast_allbranch does, not the episode-id subquery.Verified on a live install: Moodle 5.1.3, PHP 8.2, MariaDB, plugin version 2025121201 (current
master). Reproduced 2026-09-02.Found during the mod_pcast review/test pass (ClickUp 86cb46r9t). Line numbers are against
master@ 73bb255.