From 1137b7d072e42ebb9d7dba1ea2d63f5304bd0298 Mon Sep 17 00:00:00 2001
From: Michael Hawkins <michaelh@moodle.com>
Date: Tue, 29 Oct 2019 16:29:46 +0800
Subject: [PATCH] MDL-66161 output: Escaping fatal error message and URL
 strings

---
 lib/outputrenderers.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/outputrenderers.php b/lib/outputrenderers.php
index 28b7a24767a..ea27c6f1e22 100644
--- a/lib/outputrenderers.php
+++ b/lib/outputrenderers.php
@@ -2893,8 +2893,8 @@ EOD;
             $output .= $this->header();
         }
 
-        $message = '<p class="errormessage">' . $message . '</p>'.
-                '<p class="errorcode"><a href="' . $moreinfourl . '">' .
+        $message = '<p class="errormessage">' . s($message) . '</p>'.
+                '<p class="errorcode"><a href="' . s($moreinfourl) . '">' .
                 get_string('moreinformation') . '</a></p>';
         if (empty($CFG->rolesactive)) {
             $message .= '<p class="errormessage">' . get_string('installproblem', 'error') . '</p>';