Merge branch 'wip-MDL-61876-master' of git://github.com/marinaglancy/moodle

admin/settings/security.php

@@ -44,7 +44,7 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
                 new lang_string('configuserquota', 'admin', $params), $defaultuserquota, PARAM_INT, 30));
 
     $temp->add(new admin_setting_configcheckbox('forceclean', new lang_string('forceclean', 'core_admin'),
-        new lang_string('forceclean_desc', 'core_admin'), 0));
+        new lang_string('forceclean_desc', 'core_admin'), 1));
 
     $temp->add(new admin_setting_configcheckbox('allowobjectembed', new lang_string('allowobjectembed', 'admin'), new lang_string('configallowobjectembed', 'admin'), 0));
     $temp->add(new admin_setting_configcheckbox('enabletrusttext', new lang_string('enabletrusttext', 'admin'), new lang_string('configenabletrusttext', 'admin'), 0));

course/tests/externallib_test.php

@@ -858,7 +858,9 @@ class core_course_externallib_testcase extends externallib_advanced_testcase {
      * Test get_course_contents
      */
     public function test_get_course_contents() {
+        global $CFG;
         $this->resetAfterTest(true);
+        $CFG->forceclean = 0;
 
         list($course, $forumcm, $datacm, $pagecm, $labelcm, $urlcm) = $this->prepare_get_course_contents_test();
 

lib/tests/weblib_format_text_test.php

@@ -109,6 +109,9 @@ class core_weblib_format_text_testcase extends advanced_testcase {
      * @param string $expected The expected filter value
      */
     public function test_format_text_blanktarget($link, $expected) {
+        global $CFG;
+        $this->resetAfterTest();
+        $CFG->forceclean = 0;
         $actual = format_text($link, FORMAT_MOODLE, array('blanktarget' => true, 'filter' => false, 'noclean' => true));
         $this->assertEquals($expected, $actual);
     }

media/player/swf/tests/player_test.php

@@ -104,6 +104,7 @@ class media_swf_testcase extends advanced_testcase {
      */
     public function test_embed_link() {
         global $CFG;
+        $CFG->forceclean = 0;
         $url = new moodle_url('http://example.org/some_filename.swf');
         $text = html_writer::link($url, 'Watch this one');
         $content = format_text($text, FORMAT_HTML, ['trusted' => true]);
@@ -113,9 +114,13 @@ class media_swf_testcase extends advanced_testcase {
         $this->assertRegExp('~width="' . $CFG->media_default_width . '" height="' .
             $CFG->media_default_height . '"~', $content);
 
-        // Not working without trust!
+        // Not working without trust or with $CFG->forceclean!
         $content = format_text($text, FORMAT_HTML);
         $this->assertNotRegExp('~mediaplugin_swf~', $content);
+
+        $CFG->forceclean = 1;
+        $content = format_text($text, FORMAT_HTML, ['trusted' => true]);
+        $this->assertNotRegExp('~mediaplugin_swf~', $content);
     }
 
     /**
@@ -125,6 +130,8 @@ class media_swf_testcase extends advanced_testcase {
      */
     public function test_embed_media() {
         global $CFG;
+        $CFG->forceclean = 0;
+
         $url = new moodle_url('http://example.org/some_filename.swf');
         $trackurl = new moodle_url('http://example.org/some_filename.vtt');
         $text = '<video controls="true"><source src="'.$url.'"/>' .

question/type/gapselect/renderer.php

@@ -57,7 +57,8 @@ class qtype_gapselect_renderer extends qtype_elements_embedded_in_question_text_
         $orderedchoices = $question->get_ordered_choices($group);
         $selectoptions = array();
         foreach ($orderedchoices as $orderedchoicevalue => $orderedchoice) {
-            $selectoptions[$orderedchoicevalue] = $orderedchoice->text;
+            $selectoptions[$orderedchoicevalue] = $question->format_text($orderedchoice->text,
+                $question->questiontextformat, $qa, 'question', 'questiontext', $question->id);
         }
 
         $feedbackimage = '';

question/type/gapselect/rendererbase.php

@@ -40,16 +40,26 @@ abstract class qtype_elements_embedded_in_question_text_renderer
         $question = $qa->get_question();
 
         $questiontext = '';
+        // Glue question fragments together using unique placeholders, apply format_text to the result
+        // and then substitute each placeholder with the embedded element.
+        // This will ensure that format_text() is applied to the whole question but not to the embedded elements.
+        $placeholders = $this->get_fragments_glue_placeholders($question->textfragments);
         foreach ($question->textfragments as $i => $fragment) {
             if ($i > 0) {
-                $questiontext .= $this->embedded_element($qa, $i, $options);
+                $questiontext .= $placeholders[$i];
+                $embeddedelements[$placeholders[$i]] = $this->embedded_element($qa, $i, $options);
             }
             $questiontext .= $fragment;
         }
+        $questiontext = $question->format_text($questiontext,
+            $question->questiontextformat, $qa, 'question', 'questiontext', $question->id);
+        foreach ($placeholders as $i => $placeholder) {
+            $questiontext = preg_replace('/'. preg_quote($placeholder, '/') . '/',
+                $embeddedelements[$placeholder], $questiontext);
+        }
 
         $result = '';
-        $result .= html_writer::tag('div', $question->format_text($questiontext,
-                $question->questiontextformat, $qa, 'question', 'questiontext', $question->id),
+        $result .= html_writer::tag('div', $questiontext,
                 array('class' => $this->qtext_classname(), 'id' => $this->qtext_id($qa)));
 
         $result .= $this->post_qtext_elements($qa, $options);
@@ -63,6 +73,32 @@ abstract class qtype_elements_embedded_in_question_text_renderer
         return $result;
     }
 
+    /**
+     * Find strings that we can use to glue the fragments with
+     *
+     * These strings have to be all different and neither of them can be present in the text
+     *
+     * @param array $fragments
+     * @return array array with indexes from 1 to count($fragments)-1
+     */
+    protected function get_fragments_glue_placeholders($fragments) {
+        $fragmentscount = count($fragments);
+        if ($fragmentscount <= 1) {
+            return [];
+        }
+        $prefix = '[[$';
+        $postfix = ']]';
+        $text = join('', $fragments);
+        while (preg_match('/' . preg_quote($prefix, '/') . '\\d+' . preg_quote($postfix, '/') . '/', $text)) {
+            $prefix .= '$';
+        }
+        $glues = [];
+        for ($i = 1; $i < $fragmentscount; $i++) {
+            $glues[$i] = $prefix . $i . $postfix;
+        }
+        return $glues;
+    }
+
     protected function qtext_classname() {
         return 'qtext';
     }

question/type/upgrade.txt

@@ -8,6 +8,9 @@ This files describes API changes for question type plugins.
    question_manually_gradable.
   + The default implementation of is_gradable_response has been moved from question_graded_automatically to
    question_with_responses.
+  + Note that format_text() is no longer applied to the results of
+   qtype_elements_embedded_in_question_text_renderer::embedded_element(). If question type overrides
+   this method make sure you apply format_text() to any text that came from a user.
 
 === 3.1.5, 3.2.2, 3.3 ===