mirror_php/moodle
1
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-01-29 19:50:14 +01:00
Code Issues Projects Releases Wiki Activity

MDL-57729 enrol_lti: Escape the property values of the xpath elements

Browse Source
This commit is contained in:
Mihail Geshoski 2019-05-29 09:55:23 +08:00
parent 383aec8a01
commit 1fc5c588a4
1 changed files with 11 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
enrol/lti/classes/helper.php
View File

@ -576,18 +576,19 @@ class helper {
// Work out the name of the tool.
$title = self::get_name($tool);
$launchurl = self::get_launch_url($toolid);
$launchurl = $launchurl->out();
$icon = self::get_icon($tool);
$launchurl = $launchurl->out(false);
$iconurl = self::get_icon($tool);
$iconurl = $iconurl->out(false);
$securelaunchurl = null;
$secureicon = null;
$secureiconurl = null;
$vendorurl = new \moodle_url('/');
$vendorurl = $vendorurl->out();
$vendorurl = $vendorurl->out(false);
$description = self::get_description($tool);
// If we are a https site, we can add the launch url and icon urls as secure equivalents.
if (\is_https()) {
$securelaunchurl = $launchurl;
$secureicon = $icon;
$secureiconurl = $iconurl;
}
return array(
@ -595,13 +596,13 @@ class helper {
"/blti:title" => $title,
"/blti:description" => $description,
"/blti:extensions" => array(
"/lticm:property[@name='icon_url']" => $icon,
"/lticm:property[@name='secure_icon_url']" => $secureicon
"/lticm:property[@name='icon_url']" => $iconurl,
"/lticm:property[@name='secure_icon_url']" => $secureiconurl
),
"/blti:launch_url" => $launchurl,
"/blti:secure_launch_url" => $securelaunchurl,
"/blti:icon" => $icon,
"/blti:secure_icon" => $secureicon,
"/blti:icon" => $iconurl,
"/blti:secure_icon" => $secureiconurl,
"/blti:vendor" => array(
"/lticp:code" => $SITE->shortname,
"/lticp:name" => $SITE->fullname,
@ -634,7 +635,7 @@ class helper {
if (is_null($value)) {
$node->parentNode->removeChild($node);
} else {
$node->nodeValue = $value;
$node->nodeValue = s($value);
}
}
} else {