[docs] Remove `validate_parameters` from External API Docs?

[justusdieckmann]

What is the URL of the page?

https://moodledev.io/docs/5.0/apis/subsystems/external/writing-a-service
https://moodledev.io/docs/5.0/apis/subsystems/external/functions
https://moodledev.io/docs/5.0/apis/subsystems/external/security

What is the issue with this page?

Hey,

I was wondering why the documentation 'forces' developers to use validate_parameters inside an external_api execute function, when the same validation is already done by the calling external_api::call_external_function in line 228, and couldn't find an answer anywhere.

In case there is no reason, I would be happy to make a patch deleting those sections (and really happy not needing to write those - in my eyes a bit ugly - lines anymore).

Maybe @andrewnicols might be the right person to say something about that :)

Thank you very much,
Justus

Are you able to provide a patch for this?

None

[timhunt]

Becuase the external function is a public PHP method that can be called directly by other code, as well as the web service system.

[paulholden]

As Tim says, there's more discussion here https://moodle.atlassian.net/browse/MDL-49355 - I don't think we should be removing best practices from dev docs, until the consensus/coding style changes

[justusdieckmann]

Thank you very much for your answers and the link. I actually didn't know that calling external functions with unsanitized input from other code is a supported usecase. Another thing learned. Thanks!