diff --git a/message/externallib.php b/message/externallib.php
index 3c8f389b6c8..3083d0e84bd 100644
--- a/message/externallib.php
+++ b/message/externallib.php
@@ -2141,6 +2141,8 @@ class core_message_external extends external_api {
$message->usertofullname = $usertofullname;
}
+ // Clean subject of html.
+ $message->subject = clean_param($message->subject, PARAM_TEXT);
$message->text = message_format_message_text($message);
$messages[$mid] = (array) $message;
}
diff --git a/message/tests/externallib_test.php b/message/tests/externallib_test.php
index ba461adf5c8..e1a54b81351 100644
--- a/message/tests/externallib_test.php
+++ b/message/tests/externallib_test.php
@@ -1438,13 +1438,14 @@ class externallib_test extends externallib_advanced_testcase {
$eventdata->smallmessage = $eventdata->subject;
message_send($eventdata);
+ // This event contains HTML in the subject field that will be removed by the WS (otherwise it will generate an exception).
$eventdata = new \core\message\message();
$eventdata->courseid = $course->id;
$eventdata->name = 'submission';
$eventdata->component = 'mod_feedback';
$eventdata->userfrom = $user1;
$eventdata->userto = $user2;
- $eventdata->subject = 'Feedback submitted';
+ $eventdata->subject = 'Feedback submitted with html';
$eventdata->fullmessage = 'Feedback submitted from an user';
$eventdata->fullmessageformat = FORMAT_PLAIN;
$eventdata->fullmessagehtml = 'Feedback submitted';