mirror_php/moodle
1
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-06-02 06:05:31 +02:00
Code Issues Projects Releases Wiki Activity

Merge branch 'MDL-74853-401' of https://github.com/marinaglancy/moodle into MOODLE_401_STABLE

Browse Source
This commit is contained in:
Ilya Tregubov 2022-11-30 15:58:32 +03:00
commit 5c96f74a06
55 changed files with 109 additions and 109 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
admin/roles/classes/define_role_table_advanced.php
View File

@ -533,7 +533,7 @@ class core_role_define_role_table_advanced extends core_role_capability_table_wi
protected function get_description_field($id) {
return '<textarea class="form-textarea form-control" id="'. s($id) .'" name="description" rows="10" cols="50">' .
htmlspecialchars($this->role->description) .
htmlspecialchars($this->role->description, ENT_COMPAT) .
'</textarea>';
}

2
admin/settings/plugins.php
View File

@ -101,7 +101,7 @@ if ($hassiteconfig) {
new lang_string('limitconcurrentlogins', 'core_auth'),
new lang_string('limitconcurrentlogins_desc', 'core_auth'), 0, $options));
$temp->add(new admin_setting_configtext('alternateloginurl', new lang_string('alternateloginurl', 'auth'),
new lang_string('alternatelogin', 'auth', htmlspecialchars(get_login_url())), ''));
new lang_string('alternatelogin', 'auth', htmlspecialchars(get_login_url(), ENT_COMPAT)), ''));
$temp->add(new admin_setting_configtext('forgottenpasswordurl', new lang_string('forgottenpasswordurl', 'auth'),
new lang_string('forgottenpassword', 'auth'), '', PARAM_URL));
$temp->add(new admin_setting_confightmleditor('auth_instructions', new lang_string('instructions', 'auth'),

4
admin/tool/brickfield/classes/accessibility.php
View File

@ -388,13 +388,13 @@ class accessibility {
// Confirm if error is reported separately.
if ($DB->record_exists_select(manager::DB_ERRORS,
'resultid = ? AND ' . $DB->sql_compare_text('htmlcode', 255) . ' = ' . $DB->sql_compare_text('?', 255),
[$resultid, html_entity_decode($tmp->html)])) {
[$resultid, html_entity_decode($tmp->html, ENT_COMPAT)])) {
continue;
}
$error = new stdClass();
$error->resultid = $resultid;
$error->linenumber = $tmp->line;
$error->htmlcode = html_entity_decode($tmp->html);
$error->htmlcode = html_entity_decode($tmp->html, ENT_COMPAT);
$errors[] = $error;
}

2
admin/tool/brickfield/classes/local/htmlchecker/reporters/report_array.php
View File

@ -43,7 +43,7 @@ class report_array extends brickfield_accessibility_reporter {
$output[$testname]['body'] = $translation['description'];
foreach ($test as $k => $problem) {
if (is_object($problem)) {
$output[$testname]['problems'][$k]['element'] = htmlentities($problem->get_html());
$output[$testname]['problems'][$k]['element'] = htmlentities($problem->get_html(), ENT_COMPAT);
$output[$testname]['problems'][$k]['line'] = $problem->get_line();
if ($problem->message) {
$output[$testname]['problems']['message'] = $problem->message;

2
admin/tool/brickfield/classes/local/htmlchecker/reporters/report_codehighlight.php
View File

@ -67,7 +67,7 @@ class report_codehighlight extends \tool_brickfield\local\htmlchecker\brickfield
}
}
$this->dom->formatOutput = true;
$html = htmlspecialchars($this->dom->saveHTML());
$html = htmlspecialchars($this->dom->saveHTML(), ENT_COMPAT);
$html = str_replace('&quot;', '"', $html);
foreach ($this->classnames as $name) {
$html = preg_replace('/&lt;'. $name .'([^&]+)+\&gt;/', '<span \\1>', $html);

2
admin/tool/brickfield/classes/local/htmlchecker/reporters/report_xml.php
View File

@ -49,7 +49,7 @@ class report_xml extends brickfield_accessibility_reporter {
$output .= "\n\t<htmlchecker:problems>";
foreach ($test as $problem) {
if (is_object($problem)) {
$output .= "\n\t<htmlchecker:entities><![CDATA[" . htmlentities($problem->get_html()) .
$output .= "\n\t<htmlchecker:entities><![CDATA[" . htmlentities($problem->get_html(), ENT_COMPAT) .
"]]></htmlchecker:entities>";
$output .= "\n\t<htmlchecker:line>". $problem->get_line() ."</htmlchecker:line>";
if ($problem->message) {

2
admin/tool/brickfield/classes/output/printable/renderer.php
View File

@ -180,7 +180,7 @@ class renderer extends \tool_brickfield\output\renderer {
];
$data->errordata = !empty($data->errordata) ? $data->errordata : [];
foreach ($data->errordata as $err) {
$err->htmlcode = htmlentities($err->htmlcode);
$err->htmlcode = htmlentities($err->htmlcode, ENT_COMPAT);
$row = [$data->tarlabels[$err->component], $err->shortname, $err->errline, $err->htmlcode];
$table->data[] = $row;
}

2
backup/cc/cc_lib/gral_lib/functions.php
View File

@ -89,7 +89,7 @@ function array_remove_by_key($arr,$key) {
function cc_print_object($object) {
echo '<pre>' . htmlspecialchars(print_r($object,true)) . '</pre>';
echo '<pre>' . htmlspecialchars(print_r($object,true), ENT_COMPAT) . '</pre>';
}

2
course/switchrole.php
View File

@ -102,7 +102,7 @@ if ($switchrole > 0 && has_capability('moodle/role:switchroles', $context)) {
foreach ($roles as $key => $role) {
$url = new moodle_url('/course/switchrole.php', array('id' => $id, 'switchrole' => $key, 'returnurl' => $returnurl));
// Button encodes special characters, apply htmlspecialchars_decode() to avoid double escaping.
echo $OUTPUT->container($OUTPUT->single_button($url, htmlspecialchars_decode($role)), 'mx-3 mb-1');
echo $OUTPUT->container($OUTPUT->single_button($url, htmlspecialchars_decode($role, ENT_COMPAT)), 'mx-3 mb-1');
}
$url = new moodle_url($returnurl);

2
filter/tex/texdebug.php
View File

@ -248,7 +248,7 @@
chdir($latex->temp_dir);
// put the expression as a file into the temp area
$expression = html_entity_decode($expression);
$expression = html_entity_decode($expression, ENT_COMPAT);
$output .= "<p>Processing TeX expression:</p><pre>$expression</pre>\n";
$doc = $latex->construct_latex_document($expression);
$fh = fopen($tex, 'w');

10
lib/behat/classes/behat_session_trait.php
View File

@ -941,7 +941,7 @@ EOF;
$msgs[] = $errnostring . ": " .$error['message'] . " at " . $error['file'] . ": " . $error['line'];
}
$msg = "PHP errors found:\n" . implode("\n", $msgs);
throw new \Exception(htmlentities($msg));
throw new \Exception(htmlentities($msg, ENT_COMPAT));
}
return;
@ -979,7 +979,7 @@ EOF;
}
$msg = "Moodle exception: " . $errormsg->getText() . "\n" . $errorinfo;
throw new \Exception(html_entity_decode($msg));
throw new \Exception(html_entity_decode($msg, ENT_COMPAT));
}
// Debugging messages.
@ -989,7 +989,7 @@ EOF;
$msgs[] = $this->get_debug_text($debuggingmessage->getHtml());
}
$msg = "debugging() message/s found:\n" . implode("\n", $msgs);
throw new \Exception(html_entity_decode($msg));
throw new \Exception(html_entity_decode($msg, ENT_COMPAT));
}
// PHP debug messages.
@ -1000,7 +1000,7 @@ EOF;
$msgs[] = $this->get_debug_text($phpmessage->getHtml());
}
$msg = "PHP debug message/s found:\n" . implode("\n", $msgs);
throw new \Exception(html_entity_decode($msg));
throw new \Exception(html_entity_decode($msg, ENT_COMPAT));
}
// Any other backtrace.
@ -1014,7 +1014,7 @@ EOF;
$msgs[] = $backtrace . '()';
}
$msg = "Other backtraces found:\n" . implode("\n", $msgs);
throw new \Exception(htmlentities($msg));
throw new \Exception(htmlentities($msg, ENT_COMPAT));
}
}

2
lib/classes/output/mustache_pix_helper.php
View File

@ -76,7 +76,7 @@ class mustache_pix_helper {
// chars have been escaped. However, render_pix_icon
// assumes the alt arrives with no escaping. So we need
// ot un-escape here.
$text = htmlspecialchars_decode($text);
$text = htmlspecialchars_decode($text, ENT_COMPAT);
return trim($this->renderer->pix_icon($key, $text, $component));
}

8
lib/classes/text.php
View File

@ -452,7 +452,7 @@ class core_text {
if (!isset($trans_tbl)) {
if (version_compare(phpversion(), '5.3.4') < 0) {
$trans_tbl = array();
foreach (get_html_translation_table(HTML_ENTITIES) as $val=>$key) {
foreach (get_html_translation_table(HTML_ENTITIES, ENT_COMPAT) as $val=>$key) {
$trans_tbl[$key] = self::convert($val, 'ISO-8859-1', 'utf-8');
}
@ -574,12 +574,12 @@ class core_text {
// characters of each code planes 0-16 inclusive...
for ($plane = 0; $plane <= 16; $plane++) {
$base = ($plane === 0 ? '' : dechex($plane));
self::$noncharacters[] = html_entity_decode('&#x' . $base . 'fffe;');
self::$noncharacters[] = html_entity_decode('&#x' . $base . 'ffff;');
self::$noncharacters[] = html_entity_decode('&#x' . $base . 'fffe;', ENT_COMPAT);
self::$noncharacters[] = html_entity_decode('&#x' . $base . 'ffff;', ENT_COMPAT);
}
// ...And the character range U+FDD0 to U+FDEF.
for ($char = 0xfdd0; $char <= 0xfdef; $char++) {
self::$noncharacters[] = html_entity_decode('&#x' . dechex($char) . ';');
self::$noncharacters[] = html_entity_decode('&#x' . dechex($char) . ';', ENT_COMPAT);
}
}

2
lib/form/autocomplete.php
View File

@ -139,7 +139,7 @@ class MoodleQuickForm_autocomplete extends MoodleQuickForm_select {
// version of this code in the new template version (see export_for_template).
if ($this->valuehtmlcallback) {
$html = preg_replace_callback('~value="([^"]+)"~', function($matches) {
$value = html_entity_decode($matches[1]);
$value = html_entity_decode($matches[1], ENT_COMPAT);
$htmlvalue = call_user_func($this->valuehtmlcallback, $value);
if ($htmlvalue !== false) {
return $matches[0] . ' data-html="' . s($htmlvalue) . '"';

2
lib/form/tags.php
View File

@ -254,7 +254,7 @@ class MoodleQuickForm_tags extends MoodleQuickForm_autocomplete {
// Submitted tag data will be encoded, we want original text.
if (array_key_exists($this->getName(), $submitValues)) {
array_walk($submitValues[$this->getName()], static function(string &$tag): void {
$tag = html_entity_decode($tag);
$tag = html_entity_decode($tag, ENT_COMPAT);
});
}

4
lib/moodlelib.php
View File

@ -8413,7 +8413,7 @@ function count_words($string) {
// Now remove HTML tags.
$string = strip_tags($string);
// Decode HTML entities.
$string = html_entity_decode($string);
$string = html_entity_decode($string, ENT_COMPAT);
// Now, the word count is the number of blocks of characters separated
// by any sort of space. That seems to be the definition used by all other systems.
@ -8435,7 +8435,7 @@ function count_words($string) {
*/
function count_letters($string) {
$string = strip_tags($string); // Tags are out now.
$string = html_entity_decode($string);
$string = html_entity_decode($string, ENT_COMPAT);
$string = preg_replace('/[[:space:]]*/', '', $string); // Whitespace are out now.
return core_text::strlen($string);

4
lib/pear/PEAR/Exception.php
View File

@ -329,7 +329,7 @@ class PEAR_Exception extends Exception
foreach ($causes as $i => $cause) {
$html .= '<tr><td colspan="3" style="background: #ff9999">'
. str_repeat('-', $i) . ' <b>' . $cause['class'] . '</b>: '
. htmlspecialchars($cause['message']) . ' in <b>' . $cause['file'] . '</b> '
. htmlspecialchars($cause['message'], ENT_COMPAT) . ' in <b>' . $cause['file'] . '</b> '
. 'on line <b>' . $cause['line'] . '</b>'
. "</td></tr>\n";
}
@ -355,7 +355,7 @@ class PEAR_Exception extends Exception
elseif (is_int($arg) || is_double($arg)) $args[] = $arg;
else {
$arg = (string)$arg;
$str = htmlspecialchars(substr($arg, 0, 16));
$str = htmlspecialchars(substr($arg, 0, 16), ENT_COMPAT);
if (strlen($arg) > 16) $str .= '&hellip;';
$args[] = "'" . $str . "'";
}

2
lib/rsslib.php
View File

@ -491,7 +491,7 @@ function rss_end_tag($tag,$level=0,$endline=true) {
function rss_full_tag($tag, $level, $endline, $content, $attributes = null) {
$st = rss_start_tag($tag,$level,$endline,$attributes);
$co="";
$co = preg_replace("/\r\n|\r/", "\n", htmlspecialchars($content));
$co = preg_replace("/\r\n|\r/", "\n", htmlspecialchars($content, ENT_COMPAT));
$et = rss_end_tag($tag,0,true);
return $st.$co.$et;

2
lib/searchlib.php
View File

@ -71,7 +71,7 @@ class search_token {
// Need to think about this some more.
function sanitize($userstring){
return htmlspecialchars($userstring);
return htmlspecialchars($userstring, ENT_COMPAT);
}
function getValue(){
return $this->value;

4
lib/setuplib.php
View File

@ -549,7 +549,7 @@ function get_exception_info($ex) {
if (function_exists('clean_text')) {
$message = clean_text($message);
} else {
$message = htmlspecialchars($message);
$message = htmlspecialchars($message, ENT_COMPAT);
}
if (!empty($CFG->errordocroot)) {
@ -1436,7 +1436,7 @@ function redirect_if_major_upgrade_required() {
$url = $CFG->wwwroot . '/' . $CFG->admin . '/index.php';
@header($_SERVER['SERVER_PROTOCOL'] . ' 303 See Other');
@header('Location: ' . $url);
echo bootstrap_renderer::plain_redirect_message(htmlspecialchars($url));
echo bootstrap_renderer::plain_redirect_message(htmlspecialchars($url, ENT_COMPAT));
exit;
}
}

2
lib/tablelib.php
View File

@ -2204,7 +2204,7 @@ class table_default_export_format_parent {
function format_text($text, $format=FORMAT_MOODLE, $options=NULL, $courseid=NULL) {
//use some whitespace to indicate where there was some line spacing.
$text = str_replace(array('</p>', "\n", "\r"), ' ', $text);
return html_entity_decode(strip_tags($text));
return html_entity_decode(strip_tags($text), ENT_COMPAT);
}
/**

4
lib/tests/other/todochecker.php
View File

@ -82,9 +82,9 @@ if (empty($found)) {
}
$line = str_replace($issueid, '<a href="' . $issueurl . '" title="' . s($issuesummary) .
'">' . $issuename . '</a>', htmlspecialchars($line));
'">' . $issuename . '</a>', htmlspecialchars($line, ENT_COMPAT));
} else {
$line = htmlspecialchars($line);
$line = htmlspecialchars($line, ENT_COMPAT);
$error = 'No associated tracker issue.';
}

8
lib/tests/text_test.php
View File

@ -521,16 +521,16 @@ class text_test extends advanced_testcase {
$this->assertSame('Frogs!', core_text::remove_unicode_non_characters('Frogs!'));
// Even if they contain some very scary characters.
$example = html_entity_decode('A&#xfffd;&#x1d15f;B');
$example = html_entity_decode('A&#xfffd;&#x1d15f;B', ENT_COMPAT);
$this->assertSame($example, core_text::remove_unicode_non_characters($example));
// Non-characters are removed wherever they may be, with other characters left.
$example = html_entity_decode('&#xfffe;A&#xffff;B&#x8fffe;C&#xfdd0;D&#xfffd;E&#xfdd5;');
$expected = html_entity_decode('ABCD&#xfffd;E');
$example = html_entity_decode('&#xfffe;A&#xffff;B&#x8fffe;C&#xfdd0;D&#xfffd;E&#xfdd5;', ENT_COMPAT);
$expected = html_entity_decode('ABCD&#xfffd;E', ENT_COMPAT);
$this->assertSame($expected, core_text::remove_unicode_non_characters($example));
// If you only have a non-character, you get empty string.
$example = html_entity_decode('&#xfffe;');
$example = html_entity_decode('&#xfffe;', ENT_COMPAT);
$this->assertSame('', core_text::remove_unicode_non_characters($example));
// Check that null argument is allowed.

2
lib/webdavlib.php
View File

@ -1709,7 +1709,7 @@ EOD;
*/
private function translate_uri($uri) {
// remove all html entities...
$native_path = html_entity_decode($uri);
$native_path = html_entity_decode($uri, ENT_COMPAT);
$parts = explode('/', $native_path);
for ($i = 0; $i < count($parts); $i++) {
// check if part is allready utf8

4
lib/weblib.php
View File

@ -3439,7 +3439,7 @@ class html_progress_trace extends progress_trace {
* @return void Output is echo'd
*/
public function output($message, $depth = 0) {
echo '<p>', str_repeat('&#160;&#160;', $depth), htmlspecialchars($message), "</p>\n";
echo '<p>', str_repeat('&#160;&#160;', $depth), htmlspecialchars($message, ENT_COMPAT), "</p>\n";
flush();
}
}
@ -3480,7 +3480,7 @@ class html_list_progress_trace extends progress_trace {
if ($samedepth) {
echo "</li>\n<li>";
}
echo htmlspecialchars($message);
echo htmlspecialchars($message, ENT_COMPAT);
flush();
}

2
lib/xmldb/xmldb_field.php
View File

@ -525,7 +525,7 @@ class xmldb_field extends xmldb_object {
$o.= ' DECIMALS="' . $this->decimals . '"';
}
if ($this->comment) {
$o.= ' COMMENT="' . htmlspecialchars($this->comment) . '"';
$o.= ' COMMENT="' . htmlspecialchars($this->comment, ENT_COMPAT) . '"';
}
$o.= '/>' . "\n";

2
lib/xmldb/xmldb_index.php
View File

@ -248,7 +248,7 @@ class xmldb_index extends xmldb_object {
$o.= ' HINTS="' . implode(', ', $this->hints) . '"';
}
if ($this->comment) {
$o.= ' COMMENT="' . htmlspecialchars($this->comment) . '"';
$o.= ' COMMENT="' . htmlspecialchars($this->comment, ENT_COMPAT) . '"';
}
$o.= '/>' . "\n";

2
lib/xmldb/xmldb_key.php
View File

@ -374,7 +374,7 @@ class xmldb_key extends xmldb_object {
$o.= ' REFFIELDS="' . implode(', ', $this->reffields) . '"';
}
if ($this->comment) {
$o.= ' COMMENT="' . htmlspecialchars($this->comment) . '"';
$o.= ' COMMENT="' . htmlspecialchars($this->comment, ENT_COMPAT) . '"';
}
$o.= '/>' . "\n";

2
lib/xmldb/xmldb_structure.php
View File

@ -344,7 +344,7 @@ class xmldb_structure extends xmldb_object {
$o.= '<XMLDB PATH="' . $this->path . '"';
$o.= ' VERSION="' . $this->version . '"';
if ($this->comment) {
$o.= ' COMMENT="' . htmlspecialchars($this->comment) . '"'."\n";
$o.= ' COMMENT="' . htmlspecialchars($this->comment, ENT_COMPAT) . '"'."\n";
}
$rel = array_fill(0, count(explode('/', $this->path)), '..');
$rel = implode('/', $rel);

2
lib/xmldb/xmldb_table.php
View File

@ -731,7 +731,7 @@ class xmldb_table extends xmldb_object {
$o = '';
$o.= ' <TABLE NAME="' . $this->name . '"';
if ($this->comment) {
$o.= ' COMMENT="' . htmlspecialchars($this->comment) . '"';
$o.= ' COMMENT="' . htmlspecialchars($this->comment, ENT_COMPAT) . '"';
}
$o.= '>' . "\n";
// Now the fields

2
media/classes/player_native.php
View File

@ -42,7 +42,7 @@ abstract class core_media_player_native extends core_media_player {
*/
public static function get_attribute($tag, $attrname, $type = PARAM_RAW) {
if (preg_match('/^<[^>]*\b' . $attrname . '="(.*?)"/is', $tag, $matches)) {
return clean_param(htmlspecialchars_decode($matches[1]), $type);
return clean_param(htmlspecialchars_decode($matches[1], ENT_COMPAT), $type);
} else if (preg_match('~^<[^>]*\b' . $attrname . '[ />]"~is', $tag, $matches)) {
// Some attributes may not have value, for example this is valid: <video controls>.
return clean_param("true", $type);

4
mod/assign/feedback/editpdf/classes/pdf.php
View File

@ -587,9 +587,9 @@ class pdf extends TcpdfFpdi {
$fullerror = '<pre>'.get_string('command', 'assignfeedback_editpdf')."\n";
$fullerror .= $command . "\n\n";
$fullerror .= get_string('result', 'assignfeedback_editpdf')."\n";
$fullerror .= htmlspecialchars($result) . "\n\n";
$fullerror .= htmlspecialchars($result, ENT_COMPAT) . "\n\n";
$fullerror .= get_string('output', 'assignfeedback_editpdf')."\n";
$fullerror .= htmlspecialchars(implode("\n", $output)) . '</pre>';
$fullerror .= htmlspecialchars(implode("\n", $output), ENT_COMPAT) . '</pre>';
throw new \moodle_exception('errorgenerateimage', 'assignfeedback_editpdf', '', $fullerror);
}
}

2
mod/bigbluebuttonbn/classes/local/helpers/mod_helper.php
View File

@ -41,7 +41,7 @@ class mod_helper {
self::process_pre_save_instance($bigbluebuttonbn);
self::process_pre_save_checkboxes($bigbluebuttonbn);
self::process_pre_save_common($bigbluebuttonbn);
$bigbluebuttonbn->participants = htmlspecialchars_decode($bigbluebuttonbn->participants);
$bigbluebuttonbn->participants = htmlspecialchars_decode($bigbluebuttonbn->participants, ENT_COMPAT);
}
/**

4
mod/book/tool/exportimscp/locallib.php
View File

@ -135,7 +135,7 @@ function booktool_exportimscp_prepare_files($book, $context) {
<manifest xmlns="http://www.imsglobal.org/xsd/imscp_v1p1" xmlns:imsmd="http://www.imsglobal.org/xsd/imsmd_v1p2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" identifier="MANIFEST-' . md5($CFG->wwwroot . '-' . $book->course . '-' . $book->id) . '" xsi:schemaLocation="http://www.imsglobal.org/xsd/imscp_v1p1 imscp_v1p1.xsd http://www.imsglobal.org/xsd/imsmd_v1p2 imsmd_v1p2p2.xsd">
<organizations default="MOODLE-' . $book->course . '-' . $book->id . '">
<organization identifier="MOODLE-' . $book->course . '-' . $book->id . '" structure="hierarchical">
<title>' . htmlspecialchars($bookname) . '</title>';
<title>' . htmlspecialchars($bookname, ENT_COMPAT) . '</title>';
// To store the prev level (book only have 0 and 1)
$prevlevel = null;
@ -170,7 +170,7 @@ function booktool_exportimscp_prepare_files($book, $context) {
// Add the imsitems
$imsitems .= $currspaces .' <item identifier="ITEM-' . $book->course . '-' . $book->id . '-' . $chapter->pagenum .'" isvisible="true" identifierref="RES-' .
$book->course . '-' . $book->id . '-' . $chapter->pagenum . "\">\n" .
$currspaces . ' <title>' . htmlspecialchars($chaptertitle) . '</title>' . "\n";
$currspaces . ' <title>' . htmlspecialchars($chaptertitle, ENT_COMPAT) . '</title>' . "\n";
// Add the imsresources
// First, check if we have localfiles

8
mod/data/classes/preset.php
View File

@ -710,7 +710,7 @@ class preset {
$presetxmldata = "<preset>\n\n";
// Add description.
$presetxmldata .= '<description>' . htmlspecialchars($this->description) . "</description>\n\n";
$presetxmldata .= '<description>' . htmlspecialchars($this->description, ENT_COMPAT) . "</description>\n\n";
// Add settings.
// Raw settings are not preprocessed during saving of presets.
@ -729,12 +729,12 @@ class preset {
$instance = $this->manager->get_instance();
// First, settings that do not require any conversion.
foreach ($rawsettings as $setting) {
$presetxmldata .= "<$setting>" . htmlspecialchars($instance->$setting) . "</$setting>\n";
$presetxmldata .= "<$setting>" . htmlspecialchars($instance->$setting, ENT_COMPAT) . "</$setting>\n";
}
// Now specific settings.
if ($instance->defaultsort > 0 && $sortfield = data_get_field_from_id($instance->defaultsort, $instance)) {
$presetxmldata .= '<defaultsort>' . htmlspecialchars($sortfield->field->name) . "</defaultsort>\n";
$presetxmldata .= '<defaultsort>' . htmlspecialchars($sortfield->field->name, ENT_COMPAT) . "</defaultsort>\n";
} else {
$presetxmldata .= "<defaultsort>0</defaultsort>\n";
}
@ -748,7 +748,7 @@ class preset {
$presetxmldata .= "<field>\n";
foreach ($field as $key => $value) {
if ($value != '' && $key != 'id' && $key != 'dataid') {
$presetxmldata .= "<$key>" . htmlspecialchars($value) . "</$key>\n";
$presetxmldata .= "<$key>" . htmlspecialchars($value, ENT_COMPAT) . "</$key>\n";
}
}
$presetxmldata .= "</field>\n\n";

2
mod/data/field/latlong/field.class.php
View File

@ -223,7 +223,7 @@ class data_field_latlong extends data_field_base {
array_keys($urlreplacements),
array_values($urlreplacements),
$this->linkoutservices[$servicename]
) . "'>".htmlspecialchars($servicename)."</option>";
) . "'>".htmlspecialchars($servicename, ENT_COMPAT)."</option>";
}
// NB! If you are editing this, make sure you don't break the javascript reference "previousSibling"
// which allows the "Go" button to refer to the drop-down selector.

2
mod/data/field/latlong/kml.php
View File

@ -171,7 +171,7 @@ function data_latlong_kml_get_item_name($content, $field) {
$name = '';
if($field->param2 > 0) {
$name = htmlspecialchars($DB->get_field('data_content', 'content', array('fieldid'=>$field->param2, 'recordid'=>$content->recordid)));
$name = htmlspecialchars($DB->get_field('data_content', 'content', array('fieldid'=>$field->param2, 'recordid'=>$content->recordid)), ENT_COMPAT);
}elseif($field->param2 == -2) {
$name = $content->content . ', ' . $content->content1;
}

2
mod/feedback/lib.php
View File

@ -2785,7 +2785,7 @@ function feedback_send_email_html($info, $course, $cm) {
function feedback_encode_target_url($url) {
if (strpos($url, '?')) {
list($part1, $part2) = explode('?', $url, 2); //maximal 2 parts
return $part1 . '?' . htmlentities($part2);
return $part1 . '?' . htmlentities($part2, ENT_COMPAT);
} else {
return $url;
}

22
mod/forum/classes/output/forum_post.php
View File

@ -154,19 +154,19 @@ class forum_post implements \renderable, \templatable {
protected function export_for_template_text(\mod_forum_renderer $renderer) {
$data = $this->export_for_template_shared($renderer);
return $data + array(
'id' => html_entity_decode($this->post->id),
'coursename' => html_entity_decode($this->get_coursename()),
'courselink' => html_entity_decode($this->get_courselink()),
'forumname' => html_entity_decode($this->get_forumname()),
'showdiscussionname' => html_entity_decode($this->get_showdiscussionname()),
'discussionname' => html_entity_decode($this->get_discussionname()),
'subject' => html_entity_decode($this->get_subject()),
'authorfullname' => html_entity_decode($this->get_author_fullname()),
'postdate' => html_entity_decode($this->get_postdate()),
'id' => html_entity_decode($this->post->id, ENT_COMPAT),
'coursename' => html_entity_decode($this->get_coursename(), ENT_COMPAT),
'courselink' => html_entity_decode($this->get_courselink(), ENT_COMPAT),
'forumname' => html_entity_decode($this->get_forumname(), ENT_COMPAT),
'showdiscussionname' => html_entity_decode($this->get_showdiscussionname(), ENT_COMPAT),
'discussionname' => html_entity_decode($this->get_discussionname(), ENT_COMPAT),
'subject' => html_entity_decode($this->get_subject(), ENT_COMPAT),
'authorfullname' => html_entity_decode($this->get_author_fullname(), ENT_COMPAT),
'postdate' => html_entity_decode($this->get_postdate(), ENT_COMPAT),
// Format some components according to the renderer.
'message' => html_entity_decode($renderer->format_message_text($this->cm, $this->post)),
'attachments' => html_entity_decode($renderer->format_message_attachments($this->cm, $this->post)),
'message' => html_entity_decode($renderer->format_message_text($this->cm, $this->post), ENT_COMPAT),
'attachments' => html_entity_decode($renderer->format_message_attachments($this->cm, $this->post), ENT_COMPAT),
'canreply' => $this->canreply,
'permalink' => $this->get_permalink(),

8
mod/lesson/pagetypes/matching.php
View File

@ -91,7 +91,7 @@ class lesson_page_type_matching extends lesson_page {
if (!empty($responses)) {
shuffle($responses);
foreach ($responses as $response) {
$responseoptions[htmlspecialchars($response)] = $response;
$responseoptions[htmlspecialchars($response, ENT_COMPAT)] = $response;
}
}
if (isset($USER->modattempts[$this->lesson->id]) && !empty($attempt->useranswer)) {
@ -211,7 +211,7 @@ class lesson_page_type_matching extends lesson_page {
$result->noanswer = true;
return $result;
}
$value = htmlspecialchars_decode($value);
$value = htmlspecialchars_decode($value, ENT_COMPAT);
$userresponse[] = $value;
// Make sure the user's answer exists in question's answer
if (array_key_exists($id, $answers)) {
@ -577,7 +577,7 @@ class lesson_display_answer_form_matching extends moodleform {
$responseid = 'response['.$answer->id.']';
if ($hasattempt) {
$responseid = 'response_'.$answer->id;
$mform->addElement('hidden', 'response['.$answer->id.']', htmlspecialchars($useranswers[$i]));
$mform->addElement('hidden', 'response['.$answer->id.']', htmlspecialchars($useranswers[$i], ENT_COMPAT));
// Temporary fixed until MDL-38885 gets integrated
$mform->setType('response', PARAM_TEXT);
}
@ -585,7 +585,7 @@ class lesson_display_answer_form_matching extends moodleform {
$mform->addElement('select', $responseid, format_text($answer->answer,$answer->answerformat,$options), $responseoptions, $disabled);
$mform->setType($responseid, PARAM_TEXT);
if ($hasattempt) {
$mform->setDefault($responseid, htmlspecialchars(trim($useranswers[$i])));
$mform->setDefault($responseid, htmlspecialchars(trim($useranswers[$i]), ENT_COMPAT));
} else {
$mform->setDefault($responseid, 'answeroption');
}

4
mod/lti/auth.php
View File

@ -157,8 +157,8 @@ $r = '<form action="' . $redirecturi . "\" name=\"ltiAuthForm\" id=\"ltiAuthForm
"method=\"post\" enctype=\"application/x-www-form-urlencoded\">\n";
if (!empty($params)) {
foreach ($params as $key => $value) {
$key = htmlspecialchars($key);
$value = htmlspecialchars($value);
$key = htmlspecialchars($key, ENT_COMPAT);
$value = htmlspecialchars($value, ENT_COMPAT);
$r .= " <input type=\"hidden\" name=\"{$key}\" value=\"{$value}\"/>\n";
}
}

12
mod/lti/locallib.php
View File

@ -3557,8 +3557,8 @@ function lti_post_launch_html($newparms, $endpoint, $debug=false) {
// Contruct html for the launch parameters.
foreach ($newparms as $key => $value) {
$key = htmlspecialchars($key);
$value = htmlspecialchars($value);
$key = htmlspecialchars($key, ENT_COMPAT);
$value = htmlspecialchars($value, ENT_COMPAT);
if ( $key == "ext_submit" ) {
$r .= "<input type=\"submit\"";
} else {
@ -3590,8 +3590,8 @@ function lti_post_launch_html($newparms, $endpoint, $debug=false) {
$r .= $endpoint . "<br/>\n&nbsp;<br/>\n";
$r .= "<b>".get_string("basiclti_parameters", "lti")."</b><br/>\n";
foreach ($newparms as $key => $value) {
$key = htmlspecialchars($key);
$value = htmlspecialchars($value);
$key = htmlspecialchars($key, ENT_COMPAT);
$value = htmlspecialchars($value, ENT_COMPAT);
$r .= "$key = $value<br/>\n";
}
$r .= "&nbsp;<br/>\n";
@ -3634,8 +3634,8 @@ function lti_initiate_login($courseid, $cmid, $instance, $config, $messagetype =
"encType=\"application/x-www-form-urlencoded\">\n";
foreach ($params as $key => $value) {
$key = htmlspecialchars($key);
$value = htmlspecialchars($value);
$key = htmlspecialchars($key, ENT_COMPAT);
$value = htmlspecialchars($value, ENT_COMPAT);
$r .= " <input type=\"hidden\" name=\"{$key}\" value=\"{$value}\"/>\n";
}
$r .= "</form>\n";

2
mod/wiki/parser/markups/creole.php
View File

@ -94,7 +94,7 @@ class creole_parser extends wiki_markup_parser {
public function get_section($header, $text, $clean = false) {
// The requested header is likely to have been passed to htmlspecialchars in
// self::before_parsing(), therefore we should decode it when looking for it.
return parent::get_section(htmlspecialchars_decode($header), $text, $clean);
return parent::get_section(htmlspecialchars_decode($header, ENT_COMPAT), $text, $clean);
}
protected function header_block_rule($match) {

4
question/format/xml/format.php
View File

@ -1125,7 +1125,7 @@ class qformat_xml extends qformat_default {
* @return string the string, wrapped in CDATA if necessary.
*/
public function xml_escape($string) {
if (!empty($string) && htmlspecialchars($string) != $string) {
if (!empty($string) && htmlspecialchars($string, ENT_COMPAT) != $string) {
// If the string contains something that looks like the end
// of a CDATA section, then we need to avoid errors by splitting
// the string between two CDATA sections.
@ -1220,7 +1220,7 @@ class qformat_xml extends qformat_default {
$idnumber = '';
if (isset($question->idnumber)) {
$idnumber = htmlspecialchars($question->idnumber);
$idnumber = htmlspecialchars($question->idnumber, ENT_COMPAT);
}
// Categories are a special case.

4
question/type/gapselect/edit_form_base.php
View File

@ -89,7 +89,7 @@ class qtype_gapselect_edit_form_base extends question_edit_form {
*/
private function allowed_tags_message($badtag) {
$a = new stdClass();
$a->tag = htmlspecialchars($badtag);
$a->tag = htmlspecialchars($badtag, ENT_COMPAT);
$a->allowed = $this->get_list_of_printable_allowed_tags($this->allowedhtmltags);
if ($a->allowed) {
return get_string('tagsnotallowed', 'qtype_gapselect', $a);
@ -107,7 +107,7 @@ class qtype_gapselect_edit_form_base extends question_edit_form {
private function get_list_of_printable_allowed_tags($allowedhtmltags) {
$allowedtaglist = array();
foreach ($allowedhtmltags as $htmltag) {
$allowedtaglist[] = htmlspecialchars('<' . $htmltag . '>');
$allowedtaglist[] = htmlspecialchars('<' . $htmltag . '>', ENT_COMPAT);
}
return implode(', ', $allowedtaglist);
}

2
question/type/match/tests/walkthrough_test.php
View File

@ -396,7 +396,7 @@ class walkthrough_test extends \qbehaviour_walkthrough_test_base {
$this->displayoptions->history = 1;
$this->check_current_output(
new \question_pattern_expectation('/' .
preg_quote(htmlspecialchars($rightresponsesummary), '/') . '/'));
preg_quote(htmlspecialchars($rightresponsesummary, ENT_COMPAT), '/') . '/'));
}
public function test_match_clear_wrong() {

4
question/type/multianswer/edit_multianswer_form.php
View File

@ -415,7 +415,7 @@ class qtype_multianswer_edit_form extends question_edit_form {
}
$defaultvalues[$prefix.'answer['.$key.']'] =
htmlspecialchars($answer);
htmlspecialchars($answer, ENT_COMPAT);
}
if ($answercount == 0) {
if ($subquestion->qtype == 'multichoice') {
@ -433,7 +433,7 @@ class qtype_multianswer_edit_form extends question_edit_form {
foreach ($subquestion->feedback as $key => $answer) {
$defaultvalues[$prefix.'feedback['.$key.']'] =
htmlspecialchars ($answer['text']);
htmlspecialchars ($answer['text'], ENT_COMPAT);
}
foreach ($subquestion->fraction as $key => $answer) {
$defaultvalues[$prefix.'fraction['.$key.']'] = $answer;

2
reportbuilder/classes/table/custom_report_table.php
View File

@ -340,7 +340,7 @@ class custom_report_table extends base_report_table {
// We need a cleaned version (without tags/entities) of the first row column to use as toggle button.
$rowfirstcolumn = strip_tags(reset($row));
$buttontitle = $rowfirstcolumn !== ''
? get_string('showhide', 'core_reportbuilder', html_entity_decode($rowfirstcolumn))
? get_string('showhide', 'core_reportbuilder', html_entity_decode($rowfirstcolumn, ENT_COMPAT))
: get_string('showhidecard', 'core_reportbuilder');
$button = html_writer::tag('button', $buttonicon, [

4
repository/url/lib.php
View File

@ -128,7 +128,7 @@ EOD;
if (empty($baseurl)) {
$url = $relativeurl;
} else {
$url = htmlspecialchars_decode(url_to_absolute($baseurl, $relativeurl));
$url = htmlspecialchars_decode(url_to_absolute($baseurl, $relativeurl), ENT_COMPAT);
}
if (in_array($url, $this->processedfiles)) {
// Avoid endless recursion for the same URL with same parameters.
@ -210,7 +210,7 @@ EOD;
if (empty($list['list'])) {
$list['list'] = array();
}
$src = url_to_absolute($baseurl, htmlspecialchars_decode($url));
$src = url_to_absolute($baseurl, htmlspecialchars_decode($url, ENT_COMPAT));
foreach ($list['list'] as $image) {
if ($image['source'] == $src) {
return;

12
search/engine/solr/tests/engine_test.php
View File

@ -1242,20 +1242,20 @@ class engine_test extends \advanced_testcase {
// It is possible to enter into a Moodle database content containing these characters,
// which are Unicode non-characters / byte order marks. If sent to Solr, these cause
// failures.
$boguscontent = html_entity_decode('&#xfffe;') . 'frog';
$boguscontent = html_entity_decode('&#xfffe;', ENT_COMPAT) . 'frog';
$this->create_search_record($course1->id, $course1context->id, 'C1', $boguscontent);
$boguscontent = html_entity_decode('&#xffff;') . 'frog';
$boguscontent = html_entity_decode('&#xffff;', ENT_COMPAT) . 'frog';
$this->create_search_record($course1->id, $course1context->id, 'C1', $boguscontent);
// Unicode Standard Version 9.0 - Core Specification, section 23.7, lists 66 non-characters
// in total. Here are some of them - these work OK for me but it may depend on platform.
$boguscontent = html_entity_decode('&#xfdd0;') . 'frog';
$boguscontent = html_entity_decode('&#xfdd0;', ENT_COMPAT) . 'frog';
$this->create_search_record($course1->id, $course1context->id, 'C1', $boguscontent);
$boguscontent = html_entity_decode('&#xfdef;') . 'frog';
$boguscontent = html_entity_decode('&#xfdef;', ENT_COMPAT) . 'frog';
$this->create_search_record($course1->id, $course1context->id, 'C1', $boguscontent);
$boguscontent = html_entity_decode('&#x1fffe;') . 'frog';
$boguscontent = html_entity_decode('&#x1fffe;', ENT_COMPAT) . 'frog';
$this->create_search_record($course1->id, $course1context->id, 'C1', $boguscontent);
$boguscontent = html_entity_decode('&#x10ffff;') . 'frog';
$boguscontent = html_entity_decode('&#x10ffff;', ENT_COMPAT) . 'frog';
$this->create_search_record($course1->id, $course1context->id, 'C1', $boguscontent);
// Do the indexing (this will check it doesn't throw warnings).

2
search/tests/document_test.php
View File

@ -199,7 +199,7 @@ class document_test extends \advanced_testcase {
$export = $doc->export_for_template($renderer);
if ($expected) {
$authorname = htmlentities(fullname($author));
$authorname = htmlentities(fullname($author), ENT_COMPAT);
$this->assertEquals($authorname, $export['userfullname']);
} else {
$this->assertArrayNotHasKey('userfullname', $export);

2
tag/classes/tag.php
View File

@ -146,7 +146,7 @@ class core_tag_tag {
// Clean up a bit just in case the rules change again.
$tagname = clean_param($tagname, PARAM_TAG);
return $ashtml ? htmlspecialchars($tagname) : $tagname;
return $ashtml ? htmlspecialchars($tagname, ENT_COMPAT) : $tagname;
}
/**

2
user/profile/field/text/field.class.php
View File

@ -49,7 +49,7 @@ class profile_field_text extends profile_field_base {
// Create the link.
$data = '<a href="'.str_replace('$$', urlencode($data),
$this->field->param4).'" '.$target.'>'.htmlspecialchars($data).'</a>';
$this->field->param4).'" '.$target.'>'.htmlspecialchars($data, ENT_COMPAT).'</a>';
}
return $data;

4
user/selector/lib.php
View File

@ -586,7 +586,7 @@ abstract class user_selector_base {
*/
protected function output_optgroup($groupname, $users, $select) {
if (!empty($users)) {
$output = ' <optgroup label="' . htmlspecialchars($groupname) . ' (' . count($users) . ')">' . "\n";
$output = ' <optgroup label="' . htmlspecialchars($groupname, ENT_COMPAT) . ' (' . count($users) . ')">' . "\n";
foreach ($users as $user) {
$attributes = '';
if (!empty($user->disabled)) {
@ -604,7 +604,7 @@ abstract class user_selector_base {
}
}
} else {
$output = ' <optgroup label="' . htmlspecialchars($groupname) . '">' . "\n";
$output = ' <optgroup label="' . htmlspecialchars($groupname, ENT_COMPAT) . '">' . "\n";
$output .= ' <option disabled="disabled">&nbsp;</option>' . "\n";
}
$output .= " </optgroup>\n";

10
webservice/renderer.php
View File

@ -733,7 +733,7 @@ EOF;
$documentationhtml .= $this->colored_box_with_pre_tag(
get_string('phpparam', 'webservice'),
htmlentities('[' . $paramname . '] =>'
. $this->xmlrpc_param_description_html($paramdesc)),
. $this->xmlrpc_param_description_html($paramdesc), ENT_COMPAT),
'DFEEE7');
}
// POST format for the REST protocol for the argument
@ -741,7 +741,7 @@ EOF;
$documentationhtml .= $this->colored_box_with_pre_tag(
get_string('restparam', 'webservice'),
htmlentities($this->rest_param_description_html(
$paramdesc, $paramname)),
$paramdesc, $paramname), ENT_COMPAT),
'FEEBE5');
}
$documentationhtml .= html_writer::end_tag('span');
@ -771,7 +771,7 @@ EOF;
$documentationhtml .= $this->colored_box_with_pre_tag(
get_string('phpresponse', 'webservice'),
htmlentities($this->xmlrpc_param_description_html(
$description->returns_desc)),
$description->returns_desc), ENT_COMPAT),
'DFEEE7');
}
// XML response for the REST protocol
@ -783,7 +783,7 @@ EOF;
$restresponse .="</RESPONSE>" . $brakeline;
$documentationhtml .= $this->colored_box_with_pre_tag(
get_string('restcode', 'webservice'),
htmlentities($restresponse),
htmlentities($restresponse, ENT_COMPAT),
'FEEBE5');
}
}
@ -807,7 +807,7 @@ EOF;
EOF;
$documentationhtml .= $this->colored_box_with_pre_tag(
get_string('restexception', 'webservice'),
htmlentities($restexceptiontext),
htmlentities($restexceptiontext, ENT_COMPAT),
'FEEBE5');
$documentationhtml .= html_writer::end_tag('span');