moodle/moodle
3
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-08-05 08:56:36 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDL-70767 feedback: Prevent xss in feedback answer text.

Browse source
This commit is contained in:
Ilya Tregubov 2021-03-02 15:59:43 +02:00 • committed by Eloy Lafuente (stronk7)
parent f3e6ed90d0
commit 67aa4abd73
2 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
mod/feedback/classes/complete_form.php
View file

@ -323,7 +323,7 @@ class mod_feedback_complete_form extends moodleform {
// Set default value.
if ($setdefaultvalue && ($tmpvalue = $this->get_item_value($item))) {
$this->_form->setDefault($element->getName(), htmlspecialchars_decode($tmpvalue, ENT_QUOTES));
$this->_form->setDefault($element->getName(), s($tmpvalue));
}
// Freeze if needed.

2
mod/feedback/classes/responses_table.php
View file

@ -196,7 +196,7 @@ class mod_feedback_responses_table extends table_sql {
$itemobj = feedback_get_item_class($items[$matches[1]]->typ);
$printval = $itemobj->get_printval($items[$matches[1]], (object) ['value' => $row->$column]);
if ($this->is_downloading()) {
$printval = html_entity_decode($printval, ENT_QUOTES);
$printval = s($printval);
}
return trim($printval);
}