diff --git a/message/externallib.php b/message/externallib.php index 3c8f389b6c8..3083d0e84bd 100644 --- a/message/externallib.php +++ b/message/externallib.php @@ -2141,6 +2141,8 @@ class core_message_external extends external_api { $message->usertofullname = $usertofullname; } + // Clean subject of html. + $message->subject = clean_param($message->subject, PARAM_TEXT); $message->text = message_format_message_text($message); $messages[$mid] = (array) $message; } diff --git a/message/tests/externallib_test.php b/message/tests/externallib_test.php index ba461adf5c8..e1a54b81351 100644 --- a/message/tests/externallib_test.php +++ b/message/tests/externallib_test.php @@ -1438,13 +1438,14 @@ class externallib_test extends externallib_advanced_testcase { $eventdata->smallmessage = $eventdata->subject; message_send($eventdata); + // This event contains HTML in the subject field that will be removed by the WS (otherwise it will generate an exception). $eventdata = new \core\message\message(); $eventdata->courseid = $course->id; $eventdata->name = 'submission'; $eventdata->component = 'mod_feedback'; $eventdata->userfrom = $user1; $eventdata->userto = $user2; - $eventdata->subject = 'Feedback submitted'; + $eventdata->subject = 'Feedback submitted with html'; $eventdata->fullmessage = 'Feedback submitted from an user'; $eventdata->fullmessageformat = FORMAT_PLAIN; $eventdata->fullmessagehtml = 'Feedback submitted';