From 9216860b883efb7e3830ef0c856c632e2154c205 Mon Sep 17 00:00:00 2001
From: Tim Hunt <T.J.Hunt@open.ac.uk>
Date: Fri, 26 Feb 2021 12:46:32 +0000
Subject: [PATCH] MDL-71009 question bank: escape idnumbers when displayed

---
 .../bank/question_name_idnumber_tags_column.php        |  2 +-
 question/tests/behat/sort_questions.feature            | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/question/classes/bank/question_name_idnumber_tags_column.php b/question/classes/bank/question_name_idnumber_tags_column.php
index 872e1d82fe2..85cea05cda3 100644
--- a/question/classes/bank/question_name_idnumber_tags_column.php
+++ b/question/classes/bank/question_name_idnumber_tags_column.php
@@ -57,7 +57,7 @@ class question_name_idnumber_tags_column extends question_name_column {
         if ($question->idnumber !== null && $question->idnumber !== '') {
             echo ' ' . \html_writer::span(
                             \html_writer::span(get_string('idnumber', 'question'), 'accesshide') . ' ' .
-                            \html_writer::span($question->idnumber, 'badge badge-primary'), 'ml-1');
+                            \html_writer::span(s($question->idnumber), 'badge badge-primary'), 'ml-1');
         }
 
         // Question tags.
diff --git a/question/tests/behat/sort_questions.feature b/question/tests/behat/sort_questions.feature
index 25a103ec49c..af57ff9660e 100644
--- a/question/tests/behat/sort_questions.feature
+++ b/question/tests/behat/sort_questions.feature
@@ -18,10 +18,10 @@ Feature: The questions in the question bank can be sorted in various ways
       | contextlevel | reference | name           |
       | Course       | C1        | Test questions |
     And the following "questions" exist:
-      | questioncategory | qtype     | name              | user     | questiontext    | idnumber  |
-      | Test questions   | essay     | A question 1 name | admin    | Question 1 text | numidnuma |
-      | Test questions   | essay     | B question 2 name | teacher1 | Question 2 text |           |
-      | Test questions   | numerical | C question 3 name | teacher1 | Question 3 text | numidnumc |
+      | questioncategory | qtype     | name              | user     | questiontext    | idnumber    |
+      | Test questions   | essay     | A question 1 name | admin    | Question 1 text | numidnum</a |
+      | Test questions   | essay     | B question 2 name | teacher1 | Question 2 text |             |
+      | Test questions   | numerical | C question 3 name | teacher1 | Question 3 text | numidnum</c |
     And I log in as "teacher1"
     And I am on "Course 1" course homepage
     And I navigate to "Question bank > Questions" in current page administration
@@ -34,7 +34,7 @@ Feature: The questions in the question bank can be sorted in various ways
   Scenario: The questions can be sorted by idnumber
     When I follow "Sort by ID number ascending"
     Then "C question 3 name" "checkbox" should appear after "A question 1 name" "checkbox"
-    And I should see "numidnumc" in the "C question 3 name" "table_row"
+    And I should see "numidnum</c" in the "C question 3 name" "table_row"
     And I follow "Sort by ID number descending"
     And "C question 3 name" "checkbox" should appear before "A question 1 name" "checkbox"