When a third-party AMD module is provided with an included name we must
replace it with a name that we are able to use.
The structure of an AMD module define function is:
[name], [dependencies], [callback]
String, Array, Function
Each of these is (strangely) optional.
We know that the name is the only String and will always be the first,
and we can use AST to remove a provided name before adding the
Moodle-specific name.
This should be a safe change and not lead to any changes in built code,
but will make it easier to include third-party code.
An additional logging line is also included to inform developers that a
change was made.
Quiz completion settings are only validated if they are unlocked.
Undefined behaviour in the forms API results in the completion
settings 'require passing grade' and 'completion attempts exhausted'
not being sent to the process options function if completion
settings are locked. This resulted in the completion attempts
exhausted setting being disabled whenever the quiz was saved
as it did not detect the require passing grade setting.
This changes the behaviour so that validation is only performed
if the completion settings are unlocked.
A behat test is included to ensure the setting does not change.
The format_string() function does half html escaping. It escapes < and >
characters, but does not escape ". Therefore, it put us in a situation
where neither {{}}, nor {{{}}} are suitable in templates. If we use {{}}
for an attribute (like title or aria-label), then < and > characters
will be double escaped. On the other hand, if we use {{{}}} there, a
double quote character will break HTML when it is used in an attribute.
Therefore, neither {{}}, nore {{{}}} are usable in html attributes.
Moreover, The title attribute here was redundant because it had the same
value as the link's text.
The new get_safe_orderby() and get_safe_orderby_multiple() methods
provide a centralised safe way for user submitted sorting values to be
incorporated into SQL ORDER BY. They do this by removing the need for
user submitted data to pass in any SQL and not allowing arbitrary
column values, instead using string keys which map to a predefined
list of allowed sortable columns.
Checks if a form element has attributes before
trying to get the default value. This fixes
an error when trying to get the default value
for a frozen group which does not have the
attributes array.
