MDL-66161 output: Escaping fatal error message and URL strings

2019-11-06 01:26:37 +01:00
parent c7a5fc2f35
commit 1137b7d072
1 changed files with 2 additions and 2 deletions
@@ -2893,8 +2893,8 @@ EOD;
            $output .= $this->header();
        }

-        $message = '<p class="errormessage">' . $message . '</p>'.
-                '<p class="errorcode"><a href="' . $moreinfourl . '">' .
+        $message = '<p class="errormessage">' . s($message) . '</p>'.
+                '<p class="errorcode"><a href="' . s($moreinfourl) . '">' .
                get_string('moreinformation') . '</a></p>';
        if (empty($CFG->rolesactive)) {
            $message .= '<p class="errormessage">' . get_string('installproblem', 'error') . '</p>';