mirror_php/moodle
1
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-04-21 00:12:56 +02:00
Code Issues Projects Releases Wiki Activity

MDL-70767 feedback: Prevent xss in feedback answer text.

Browse Source
This commit is contained in:
Ilya Tregubov 2021-03-02 15:59:43 +02:00 committed by Eloy Lafuente (stronk7)
parent 40720df008
commit a303eb9e9e
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
mod/feedback/classes/complete_form.php
View File

@ -323,7 +323,7 @@ class mod_feedback_complete_form extends moodleform {
// Set default value.
if ($setdefaultvalue && ($tmpvalue = $this->get_item_value($item))) {
$this->_form->setDefault($element->getName(), htmlspecialchars_decode($tmpvalue, ENT_QUOTES));
$this->_form->setDefault($element->getName(), s($tmpvalue));
}
// Freeze if needed.

2
mod/feedback/classes/responses_table.php
View File

@ -196,7 +196,7 @@ class mod_feedback_responses_table extends table_sql {
$itemobj = feedback_get_item_class($items[$matches[1]]->typ);
$printval = $itemobj->get_printval($items[$matches[1]], (object) ['value' => $row->$column]);
if ($this->is_downloading()) {
$printval = html_entity_decode($printval, ENT_QUOTES);
$printval = s($printval);
}
return trim($printval);
}