mirror_php/moodle
1
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-04-13 04:22:07 +02:00
Code Issues Projects Releases Wiki Activity

MDL-55587 core_media: Properly escape ampersand

Browse Source
This commit is contained in:
Cameron Ball 2016-08-29 18:28:10 +08:00
parent 35d5053ba2
commit 0f826e9f36
No known key found for this signature in database
GPG Key ID: 305B7F70214D810C
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
filter/mediaplugin/tests/filter_test.php
View File

@ -105,7 +105,7 @@ class filter_mediaplugin_testcase extends advanced_testcase {
$paddedurl = str_pad($originalurl, 6000, 'z');
$validpaddedurl = '<p>Some text.</p><pre style="color: rgb(0, 0, 0); line-height: normal;"><span class="mediaplugin mediaplugin_youtube">
<iframe title="Valid link" width="400" height="300"
src="https://www.youtube.com/embed/uUhWl9Lm3OM?rel=0&wmode=transparent" frameborder="0" allowfullscreen="1"></iframe>
src="https://www.youtube.com/embed/uUhWl9Lm3OM?rel=0&amp;wmode=transparent" frameborder="0" allowfullscreen="1"></iframe>
</span></pre><pre style="color: rgb(0, 0, 0); line-height: normal;">';
$validpaddedurl = str_pad($validpaddedurl, 6000 + (strlen($validpaddedurl) - strlen($originalurl)), 'z');

6
lib/medialib.php
View File

@ -540,20 +540,20 @@ class core_media_player_youtube extends core_media_player_external {
$params = '';
$start = self::get_start_time($url);
if ($start > 0) {
$params .= "start=$start&";
$params .= "start=$start&amp;";
}
$listid = $url->param('list');
// Check for non-empty but valid playlist ID.
if (!empty($listid) && !preg_match('/[^a-zA-Z0-9\-_]/', $listid)) {
// This video is part of a playlist, and we want to embed it as such.
$params .= "list=$listid&";
$params .= "list=$listid&amp;";
}
return <<<OET
<span class="mediaplugin mediaplugin_youtube">
<iframe title="$info" width="$width" height="$height"
src="https://www.youtube.com/embed/$videoid?{$params}rel=0&wmode=transparent" frameborder="0" allowfullscreen="1"></iframe>
src="https://www.youtube.com/embed/$videoid?{$params}rel=0&amp;wmode=transparent" frameborder="0" allowfullscreen="1"></iframe>
</span>
OET;