moodle/moodle
3
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-08-04 08:26:37 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

manual grading: MDL-20581 Fix potential XSS problem.

Browse source 
Thanks to Penny for spotting this.
Merged from MOODLE_19_STABLE.
This commit is contained in:
Tim Hunt 2009-11-19 17:31:41 +00:00
parent 2d0d78befd
commit 5ffd1421a5
3 changed files with 7 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
mod/quiz/db/access.php
View file

@ -65,7 +65,7 @@ $capabilities = array(
// Manually grade and comment on student attempts at a question.
'mod/quiz:grade' => array(
'riskbitmask' => RISK_SPAM | RISK_XSS,
'riskbitmask' => RISK_SPAM,
'captype' => 'write',
'contextlevel' => CONTEXT_MODULE,
'legacy' => array(
@ -77,7 +77,7 @@ $capabilities = array(
// Regrade quizzes.
'mod/quiz:regrade' => array(
'riskbitmask' => RISK_SPAM | RISK_XSS,
'riskbitmask' => RISK_SPAM,
'captype' => 'write',
'contextlevel' => CONTEXT_MODULE,
'legacy' => array(

2
mod/quiz/version.php
View file

@ -5,7 +5,7 @@
// This fragment is called by moodle_needs_upgrading() and /admin/index.php
////////////////////////////////////////////////////////////////////////////////
$module->version = 2009042000; // The (date) version of this module
$module->version = 2009111900; // The (date) version of this module
$module->requires = 2009041700; // Requires this Moodle version
$module->cron = 0; // How often should cron check this module (seconds)?

5
question/type/questiontype.php
View file

@ -946,7 +946,10 @@ class default_questiontype {
$grade .= question_format_grade($cmoptions, $question->maxgrade);
}
$comment = $state->manualcomment;
$formatoptions = new stdClass;
$formatoptions->para = false;
$comment = format_text($state->manualcomment, FORMAT_HTML,
$formatoptions, $cmoptions->course);
$commentlink = '';
if (!empty($options->questioncommentlink)) {