Merge branch 'MDL-56252-master' of git://github.com/ryanwyllie/moodle

message/amd/src/message_area_contacts.js

@@ -546,6 +546,9 @@ define(['jquery', 'core/ajax', 'core/templates', 'core/notification', 'core/cust
          * @return {String} The altered text
          */
         Contacts.prototype._getContactText = function(text) {
+            // Remove the HTML tags to render the contact text.
+            text = $(document.createElement('div')).html(text).text();
+
             if (text.length > this._messageLength) {
                 text = text.substr(0, this._messageLength - 3);
                 text += '...';

message/classes/helper.php

@@ -147,7 +147,8 @@ class helper {
         $data->messageid = null;
         if (isset($contact->smallmessage)) {
             $data->ismessaging = true;
-            $data->lastmessage = $contact->smallmessage;
+            // Strip the HTML tags from the message for displaying in the contact area.
+            $data->lastmessage = clean_param($contact->smallmessage, PARAM_NOTAGS);
             $data->useridfrom = $contact->useridfrom;
             if (isset($contact->messageid)) {
                 $data->messageid = $contact->messageid;