MBS-10346: Add validation for tenant identifier

Author: Hannes Funk

classes/local/tenant.php

@@ -37,6 +37,7 @@ class tenant {
      * Tenant class constructor.
      *
      * @param string $identifier the tenant identifier; if left empty, the default tenant is being used
+     * @throws \invalid_parameter_exception If the provided identifier contains invalid characters
      */
     public function __construct(string $identifier = '') {
         global $USER;
@@ -47,6 +48,11 @@ public function __construct(string $identifier = '') {
                 $identifier = self::DEFAULT_IDENTIFIER;
             }
         }
+
+        if (!preg_match('/^[A-Za-z0-9_\- ]+$/', $identifier)) {
+            throw new \invalid_parameter_exception('Invalid tenant identifier. Tenant identifiers can only contain alphanumeric letters, hyphens, underscores or blank spaces.');
+        }
+
         $this->identifier = $identifier;
     }
 
@@ -139,4 +145,4 @@ public function get_defaultfullname(): string {
                 ? get_string('defaulttenantname', 'local_ai_manager')
                 : $this->identifier;
     }
-}
+}