moodle/moodle
3
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-08-05 17:06:53 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDL-70767 feedback: Prevent xss in feedback answer text.

Browse source
This commit is contained in:
Ilya Tregubov 2021-03-02 15:59:43 +02:00 • committed by Eloy Lafuente (stronk7)
parent f3e6ed90d0
commit 67aa4abd73
2 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
mod/feedback/classes/complete_form.php
View file

@ -323,7 +323,7 @@ class mod_feedback_complete_form extends moodleform {
// Set default value. // Set default value.
if ($setdefaultvalue && ($tmpvalue = $this->get_item_value($item))) { if ($setdefaultvalue && ($tmpvalue = $this->get_item_value($item))) {
$this->_form->setDefault($element->getName(), htmlspecialchars_decode($tmpvalue, ENT_QUOTES)); $this->_form->setDefault($element->getName(), s($tmpvalue));
} }
// Freeze if needed. // Freeze if needed.

2
mod/feedback/classes/responses_table.php
View file

@ -196,7 +196,7 @@ class mod_feedback_responses_table extends table_sql {
$itemobj = feedback_get_item_class($items[$matches[1]]->typ); $itemobj = feedback_get_item_class($items[$matches[1]]->typ);
$printval = $itemobj->get_printval($items[$matches[1]], (object) ['value' => $row->$column]); $printval = $itemobj->get_printval($items[$matches[1]], (object) ['value' => $row->$column]);
if ($this->is_downloading()) { if ($this->is_downloading()) {
$printval = html_entity_decode($printval, ENT_QUOTES); $printval = s($printval);
} }
return trim($printval); return trim($printval);
} }