diff --git a/lib/yui/build/moodle-core-notification-ajaxexception/moodle-core-notification-ajaxexception-debug.js b/lib/yui/build/moodle-core-notification-ajaxexception/moodle-core-notification-ajaxexception-debug.js
index 3fa459606cf..da724819283 100644
--- a/lib/yui/build/moodle-core-notification-ajaxexception/moodle-core-notification-ajaxexception-debug.js
+++ b/lib/yui/build/moodle-core-notification-ajaxexception/moodle-core-notification-ajaxexception-debug.js
@@ -59,15 +59,16 @@ Y.extend(AJAXEXCEPTION, M.core.dialogue, {
             delay = this.get('hideTimeoutDelay');
         this.get(BASE).addClass('moodle-dialogue-exception');
         this.setStdModContent(Y.WidgetStdMod.HEADER,
-                '<h1 id="moodle-dialogue-'+this.get('COUNT')+'-header-text">' + config.name + '</h1>', Y.WidgetStdMod.REPLACE);
+                '<h1 id="moodle-dialogue-'+this.get('COUNT')+'-header-text">' + Y.Escape.html(config.name) + '</h1>',
+                Y.WidgetStdMod.REPLACE);
         content = Y.Node.create('<div class="moodle-ajaxexception"></div>')
-                .append(Y.Node.create('<div class="moodle-exception-message">'+this.get('error')+'</div>'))
+                .append(Y.Node.create('<div class="moodle-exception-message">'+Y.Escape.html(this.get('error'))+'</div>'))
                 .append(Y.Node.create('<div class="moodle-exception-param hidden param-debuginfo"><label>URL:</label> ' +
                         this.get('reproductionlink')+'</div>'))
                 .append(Y.Node.create('<div class="moodle-exception-param hidden param-debuginfo"><label>Debug info:</label> ' +
-                        this.get('debuginfo')+'</div>'))
+                        Y.Escape.html(this.get('debuginfo'))+'</div>'))
                 .append(Y.Node.create('<div class="moodle-exception-param hidden param-stacktrace"><label>Stack trace:</label> <pre>' +
-                        this.get('stacktrace')+'</pre></div>'));
+                        Y.Escape.html(this.get('stacktrace'))+'</pre></div>'));
         if (M.cfg.developerdebug) {
             content.all('.moodle-exception-param').removeClass('hidden');
         }
@@ -140,6 +141,7 @@ Y.extend(AJAXEXCEPTION, M.core.dialogue, {
         reproductionlink : {
             setter : function(link) {
                 if (link !== null) {
+                    link = Y.Escape.html(link);
                     link = '<a href="'+link+'">'+link.replace(M.cfg.wwwroot, '')+'</a>';
                 }
                 return link;
diff --git a/lib/yui/build/moodle-core-notification-ajaxexception/moodle-core-notification-ajaxexception-min.js b/lib/yui/build/moodle-core-notification-ajaxexception/moodle-core-notification-ajaxexception-min.js
index 43efc79c3b4..347afb50241 100644
--- a/lib/yui/build/moodle-core-notification-ajaxexception/moodle-core-notification-ajaxexception-min.js
+++ b/lib/yui/build/moodle-core-notification-ajaxexception/moodle-core-notification-ajaxexception-min.js
@@ -1 +1 @@
-YUI.add("moodle-core-notification-ajaxexception",function(e,t){var n,r,i,s,o,u,a;n="moodle-dialogue",r="notificationBase",i="yesLabel",s="noLabel",o="title",u="question",a={BASE:"moodle-dialogue-base",WRAP:"moodle-dialogue-wrap",HEADER:"moodle-dialogue-hd",BODY:"moodle-dialogue-bd",CONTENT:"moodle-dialogue-content",FOOTER:"moodle-dialogue-ft",HIDDEN:"hidden",LIGHTBOX:"moodle-dialogue-lightbox"},M.core=M.core||{};var f="Moodle AJAX exception",l;l=function(e){e.name=e.name||"Error",e.closeButton=!0,l.superclass.constructor.apply(this,[e])},e.extend(l,M.core.dialogue,{_keypress:null,initializer:function(t){var n,i=this,s=this.get("hideTimeoutDelay");this.get(r).addClass("moodle-dialogue-exception"),this.setStdModContent(e.WidgetStdMod.HEADER,'<h1 id="moodle-dialogue-'+this.get("COUNT")+'-header-text">'+t.name+"</h1>",e.WidgetStdMod.REPLACE),n=e.Node.create('<div class="moodle-ajaxexception"></div>').append(e.Node.create('<div class="moodle-exception-message">'+this.get("error")+"</div>")).append(e.Node.create('<div class="moodle-exception-param hidden param-debuginfo"><label>URL:</label> '+this.get("reproductionlink")+"</div>")).append(e.Node.create('<div class="moodle-exception-param hidden param-debuginfo"><label>Debug info:</label> '+this.get("debuginfo")+"</div>")).append(e.Node.create('<div class="moodle-exception-param hidden param-stacktrace"><label>Stack trace:</label> <pre>'+this.get("stacktrace")+"</pre></div>")),M.cfg.developerdebug&&n.all(".moodle-exception-param").removeClass("hidden"),this.setStdModContent(e.WidgetStdMod.BODY,n,e.WidgetStdMod.REPLACE),s&&(this._hideTimeout=setTimeout(function(){i.hide()},s)),this.after("visibleChange",this.visibilityChanged,this),this._keypress=e.on("key",this.hide,window,"down:13, 27",this),this.centerDialogue()},visibilityChanged:function(e){if(e.attrName==="visible"&&e.prevVal&&!e.newVal){var t=this;this._keypress.detach(),setTimeout(function(){t.destroy()},1e3)}}},{NAME:f,CSS_PREFIX:n,ATTRS:{error:{validator:e.Lang.isString,value:M.util.get_string("unknownerror","moodle")},debuginfo:{value:null},stacktrace:{value:null},reproductionlink:{setter:function(e){return e!==null&&(e='<a href="'+e+'">'+e.replace(M.cfg.wwwroot,"")+"</a>"),e},value:null},hideTimeoutDelay:{validator:e.Lang.isNumber,value:null}}}),M.core.ajaxException=l},"@VERSION@",{requires:["moodle-core-notification-dialogue"]});
+YUI.add("moodle-core-notification-ajaxexception",function(e,t){var n,r,i,s,o,u,a;n="moodle-dialogue",r="notificationBase",i="yesLabel",s="noLabel",o="title",u="question",a={BASE:"moodle-dialogue-base",WRAP:"moodle-dialogue-wrap",HEADER:"moodle-dialogue-hd",BODY:"moodle-dialogue-bd",CONTENT:"moodle-dialogue-content",FOOTER:"moodle-dialogue-ft",HIDDEN:"hidden",LIGHTBOX:"moodle-dialogue-lightbox"},M.core=M.core||{};var f="Moodle AJAX exception",l;l=function(e){e.name=e.name||"Error",e.closeButton=!0,l.superclass.constructor.apply(this,[e])},e.extend(l,M.core.dialogue,{_keypress:null,initializer:function(t){var n,i=this,s=this.get("hideTimeoutDelay");this.get(r).addClass("moodle-dialogue-exception"),this.setStdModContent(e.WidgetStdMod.HEADER,'<h1 id="moodle-dialogue-'+this.get("COUNT")+'-header-text">'+e.Escape.html(t.name)+"</h1>",e.WidgetStdMod.REPLACE),n=e.Node.create('<div class="moodle-ajaxexception"></div>').append(e.Node.create('<div class="moodle-exception-message">'+e.Escape.html(this.get("error"))+"</div>")).append(e.Node.create('<div class="moodle-exception-param hidden param-debuginfo"><label>URL:</label> '+this.get("reproductionlink")+"</div>")).append(e.Node.create('<div class="moodle-exception-param hidden param-debuginfo"><label>Debug info:</label> '+e.Escape.html(this.get("debuginfo"))+"</div>")).append(e.Node.create('<div class="moodle-exception-param hidden param-stacktrace"><label>Stack trace:</label> <pre>'+e.Escape.html(this.get("stacktrace"))+"</pre></div>")),M.cfg.developerdebug&&n.all(".moodle-exception-param").removeClass("hidden"),this.setStdModContent(e.WidgetStdMod.BODY,n,e.WidgetStdMod.REPLACE),s&&(this._hideTimeout=setTimeout(function(){i.hide()},s)),this.after("visibleChange",this.visibilityChanged,this),this._keypress=e.on("key",this.hide,window,"down:13, 27",this),this.centerDialogue()},visibilityChanged:function(e){if(e.attrName==="visible"&&e.prevVal&&!e.newVal){var t=this;this._keypress.detach(),setTimeout(function(){t.destroy()},1e3)}}},{NAME:f,CSS_PREFIX:n,ATTRS:{error:{validator:e.Lang.isString,value:M.util.get_string("unknownerror","moodle")},debuginfo:{value:null},stacktrace:{value:null},reproductionlink:{setter:function(t){return t!==null&&(t=e.Escape.html(t),t='<a href="'+t+'">'+t.replace(M.cfg.wwwroot,"")+"</a>"),t},value:null},hideTimeoutDelay:{validator:e.Lang.isNumber,value:null}}}),M.core.ajaxException=l},"@VERSION@",{requires:["moodle-core-notification-dialogue"]});
diff --git a/lib/yui/build/moodle-core-notification-ajaxexception/moodle-core-notification-ajaxexception.js b/lib/yui/build/moodle-core-notification-ajaxexception/moodle-core-notification-ajaxexception.js
index 3fa459606cf..da724819283 100644
--- a/lib/yui/build/moodle-core-notification-ajaxexception/moodle-core-notification-ajaxexception.js
+++ b/lib/yui/build/moodle-core-notification-ajaxexception/moodle-core-notification-ajaxexception.js
@@ -59,15 +59,16 @@ Y.extend(AJAXEXCEPTION, M.core.dialogue, {
             delay = this.get('hideTimeoutDelay');
         this.get(BASE).addClass('moodle-dialogue-exception');
         this.setStdModContent(Y.WidgetStdMod.HEADER,
-                '<h1 id="moodle-dialogue-'+this.get('COUNT')+'-header-text">' + config.name + '</h1>', Y.WidgetStdMod.REPLACE);
+                '<h1 id="moodle-dialogue-'+this.get('COUNT')+'-header-text">' + Y.Escape.html(config.name) + '</h1>',
+                Y.WidgetStdMod.REPLACE);
         content = Y.Node.create('<div class="moodle-ajaxexception"></div>')
-                .append(Y.Node.create('<div class="moodle-exception-message">'+this.get('error')+'</div>'))
+                .append(Y.Node.create('<div class="moodle-exception-message">'+Y.Escape.html(this.get('error'))+'</div>'))
                 .append(Y.Node.create('<div class="moodle-exception-param hidden param-debuginfo"><label>URL:</label> ' +
                         this.get('reproductionlink')+'</div>'))
                 .append(Y.Node.create('<div class="moodle-exception-param hidden param-debuginfo"><label>Debug info:</label> ' +
-                        this.get('debuginfo')+'</div>'))
+                        Y.Escape.html(this.get('debuginfo'))+'</div>'))
                 .append(Y.Node.create('<div class="moodle-exception-param hidden param-stacktrace"><label>Stack trace:</label> <pre>' +
-                        this.get('stacktrace')+'</pre></div>'));
+                        Y.Escape.html(this.get('stacktrace'))+'</pre></div>'));
         if (M.cfg.developerdebug) {
             content.all('.moodle-exception-param').removeClass('hidden');
         }
@@ -140,6 +141,7 @@ Y.extend(AJAXEXCEPTION, M.core.dialogue, {
         reproductionlink : {
             setter : function(link) {
                 if (link !== null) {
+                    link = Y.Escape.html(link);
                     link = '<a href="'+link+'">'+link.replace(M.cfg.wwwroot, '')+'</a>';
                 }
                 return link;
diff --git a/lib/yui/build/moodle-core-notification-dialogue/moodle-core-notification-dialogue-debug.js b/lib/yui/build/moodle-core-notification-dialogue/moodle-core-notification-dialogue-debug.js
index 836d3eab651..bda47c16651 100644
--- a/lib/yui/build/moodle-core-notification-dialogue/moodle-core-notification-dialogue-debug.js
+++ b/lib/yui/build/moodle-core-notification-dialogue/moodle-core-notification-dialogue-debug.js
@@ -529,4 +529,4 @@ Y.extend(DIALOGUE, Y.Panel, {
 M.core.dialogue = DIALOGUE;
 
 
-}, '@VERSION@', {"requires": ["base", "node", "panel", "event-key", "dd-plugin", "moodle-core-lockscroll"]});
+}, '@VERSION@', {"requires": ["base", "node", "panel", "escape", "event-key", "dd-plugin", "moodle-core-lockscroll"]});
diff --git a/lib/yui/build/moodle-core-notification-dialogue/moodle-core-notification-dialogue-min.js b/lib/yui/build/moodle-core-notification-dialogue/moodle-core-notification-dialogue-min.js
index 3ece0fcc5ee..49b140a598b 100644
--- a/lib/yui/build/moodle-core-notification-dialogue/moodle-core-notification-dialogue-min.js
+++ b/lib/yui/build/moodle-core-notification-dialogue/moodle-core-notification-dialogue-min.js
@@ -1 +1 @@
-YUI.add("moodle-core-notification-dialogue",function(e,t){var n,r,i,s,o,u,a;n="moodle-dialogue",r="notificationBase",i="yesLabel",s="noLabel",o="title",u="question",a={BASE:"moodle-dialogue-base",WRAP:"moodle-dialogue-wrap",HEADER:"moodle-dialogue-hd",BODY:"moodle-dialogue-bd",CONTENT:"moodle-dialogue-content",FOOTER:"moodle-dialogue-ft",HIDDEN:"hidden",LIGHTBOX:"moodle-dialogue-lightbox"},M.core=M.core||{};var f="Moodle dialogue",l,c=n+"-fullscreen",h=n+"-hidden",p=" [role=dialog]",d="[role=menubar]",v=".moodle-has-zindex",m='input:not([type="hidden"]), a[href], button, textarea, select, [tabindex]';l=function(t){var n=e.clone(t);n.COUNT=e.stamp(this);var r="moodle-dialogue-"+n.COUNT;n.notificationBase=e.Node.create('<div class="'+a.BASE+'">').append(e.Node.create('<div id="'+r+'" role="dialog" aria-labelledby="'+r+'-header-text" class="'+a.WRAP+'"></div>').append(e.Node.create('<div id="'+r+'-header-text" class="'+a.HEADER+' yui3-widget-hd"></div>')).append(e.Node.create('<div class="'+a.BODY+' yui3-widget-bd"></div>')).append(e.Node.create('<div class="'+a.FOOTER+' yui3-widget-ft"></div>'))),e.one(document.body).append(n.notificationBase),n.additionalBaseClass&&n.notificationBase.addClass(n.additionalBaseClass),n.srcNode="#"+r,n.render=typeof n.render!="undefined"?n.render:!0,n.width=n.width||"400px",typeof n.center=="undefined"?n.center=!0:n.center=n.centered&&!0,n.centered=!1,n.width==="auto"&&delete n.width,n.lightbox!==!1&&(n.modal=!0),delete n.lightbox,n.closeButton===!1?n.buttons=null:n.buttons=[{section:e.WidgetStdMod.HEADER,classNames:"closebutton",action:function(){this.hide()}}],l.superclass.constructor.apply(this,[n]),n.closeButton!==!1&&this.get("buttons").header[0].setAttribute("title",this.get("closeButtonTitle"))},e.extend(l,e.Panel,{_resizeevent:null,_orientationevent:null,_calculatedzindex:!1,initializer:function(){var t;this.get("render")&&!this.get("rendered")&&this.render(),this.makeResponsive(),this.after("visibleChange",this.visibilityChanged,this),this.get("center")&&this.centerDialogue(),this.get("modal")&&this.plug(e.M.core.LockScroll),t=this.get("boundingBox"),e.Array.each(this.get("extraClasses"),t.addClass,t),this.get("visible")&&this.applyZIndex(),this.on("maskShow",this.applyZIndex),this.get("visible")&&(this.show(),this.keyDelegation())},applyZIndex:function(){var t=1,n=1,r=this.get("boundingBox"),i=this.get("maskNode"),s=this.get("zIndex");s!==0&&!this._calculatedzindex?r.setStyle("zIndex",s):(e.all(p+", "+d+", "+v).each(function(e){var n=this.findZIndex(e);n>t&&(t=n)},this),n=(t+1).toString(),r.setStyle("zIndex",n),this.set("zIndex",n),this.get("modal")&&i.setStyle("zIndex",n),this._calculatedzindex=!0)},findZIndex:function(e){var t=e.getStyle("zIndex")||e.ancestor().getStyle("zIndex");return t?parseInt(t,10):0},visibilityChanged:function(t){var n,r;t.attrName==="visible"&&(this.get("maskNode").addClass(a.LIGHTBOX),t.prevVal&&!t.newVal&&(r=this.get("boundingBox"),this._resizeevent&&(this._resizeevent.detach(),this._resizeevent=null),this._orientationevent&&(this._orientationevent.detach(),this._orientationevent=null),r.detach("key",this.keyDelegation)),!t.prevVal&&t.newVal&&(this.applyZIndex(),this.makeResponsive(),this.shouldResizeFullscreen()||this.get("draggable")&&(n="#"+this.get("id")+" ."+a.HEADER,this.plug(e.Plugin.Drag,{handles:[n]}),e.one(n).setStyle("cursor","move")),this.keyDelegation()),this.get("center")&&!t.prevVal&&t.newVal&&this.centerDialogue())},makeResponsive:function(){var t=this.get("boundingBox"),n;this.shouldResizeFullscreen()?(t.addClass(c),t.setStyles({left:null,top:null,width:null,height:null,right:null,bottom:null}),n=e.one("#"+this.get("id")+" ."+a.BODY)):this.get("responsive")&&(t.removeClass(c).setStyles({width:this.get("width"),height:this.get("height")}),n=e.one("#"+this.get("id")+" ."+a.BODY))},centerDialogue:function(){var t=this.get("boundingBox"),n=t.hasClass(h),r,i;if(this.shouldResizeFullscreen())return;n&&t.setStyle("top","-1000px").removeClass(h),r=Math.max(Math.round((t.get("winWidth")-t.get("offsetWidth"))/2),15),i=Math.max(Math.round((t.get("winHeight")-t.get("offsetHeight"))/2),15)+e.one(window).get("scrollTop"),t.setStyles({left:r,top:i}),n&&t.addClass(h)},shouldResizeFullscreen:function(){return window===window.parent&&this.get("responsive")&&Math.floor(e.one(document.body).get("winWidth"))<this.get("responsiveWidth")},show:function(){var e=null,t=this.headerNode,n=this.bodyNode;return e=l.superclass.show.call(this),this.lockScroll&&this.lockScroll.enableScrollLock(this.shouldResizeFullscreen()),t&&t!==""?t.focus():n&&n!==""&&n.focus(),e},hide:function(e){if(e&&e.type==="key"&&e.keyCode===27&&!this.get("focused"))return;return this.lockScroll&&this.lockScroll.disableScrollLock(),l.superclass.hide.call(this,arguments)},keyDelegation:function(){var e=this.get("boundingBox");e.delegate("key",function(e){var t=e.target,n="forward";e.shiftKey&&(n="backward"),this.trapFocus(t,n)&&e.preventDefault()},"down:9",m,this)},trapFocus:function(e,t){var n=this.get("boundingBox"),r=n.one(m),i=n.all(m).pop();if(e===i&&t==="forward")return r.focus();if(e===r&&t==="backward")return i.focus()}},{NAME:f,CSS_PREFIX:n,ATTRS:{notificationBase:{},lightbox:{validator:e.Lang.isBoolean,value:!0},closeButton:{validator:e.Lang.isBoolean,value:!0},closeButtonTitle:{validator:e.Lang.isString,value:M.util.get_string("closebuttontitle","moodle")},center:{validator:e.Lang.isBoolean,value:!0},draggable:{validator:e.Lang.isBoolean,value:!1},COUNT:{value:null},responsive:{validator:e.Lang.isBoolean,value:!0},responsiveWidth:{value:768},extraClasses:{value:[]}}}),M.core.dialogue=l},"@VERSION@",{requires:["base","node","panel","event-key","dd-plugin","moodle-core-lockscroll"]});
+YUI.add("moodle-core-notification-dialogue",function(e,t){var n,r,i,s,o,u,a;n="moodle-dialogue",r="notificationBase",i="yesLabel",s="noLabel",o="title",u="question",a={BASE:"moodle-dialogue-base",WRAP:"moodle-dialogue-wrap",HEADER:"moodle-dialogue-hd",BODY:"moodle-dialogue-bd",CONTENT:"moodle-dialogue-content",FOOTER:"moodle-dialogue-ft",HIDDEN:"hidden",LIGHTBOX:"moodle-dialogue-lightbox"},M.core=M.core||{};var f="Moodle dialogue",l,c=n+"-fullscreen",h=n+"-hidden",p=" [role=dialog]",d="[role=menubar]",v=".moodle-has-zindex",m='input:not([type="hidden"]), a[href], button, textarea, select, [tabindex]';l=function(t){var n=e.clone(t);n.COUNT=e.stamp(this);var r="moodle-dialogue-"+n.COUNT;n.notificationBase=e.Node.create('<div class="'+a.BASE+'">').append(e.Node.create('<div id="'+r+'" role="dialog" aria-labelledby="'+r+'-header-text" class="'+a.WRAP+'"></div>').append(e.Node.create('<div id="'+r+'-header-text" class="'+a.HEADER+' yui3-widget-hd"></div>')).append(e.Node.create('<div class="'+a.BODY+' yui3-widget-bd"></div>')).append(e.Node.create('<div class="'+a.FOOTER+' yui3-widget-ft"></div>'))),e.one(document.body).append(n.notificationBase),n.additionalBaseClass&&n.notificationBase.addClass(n.additionalBaseClass),n.srcNode="#"+r,n.render=typeof n.render!="undefined"?n.render:!0,n.width=n.width||"400px",typeof n.center=="undefined"?n.center=!0:n.center=n.centered&&!0,n.centered=!1,n.width==="auto"&&delete n.width,n.lightbox!==!1&&(n.modal=!0),delete n.lightbox,n.closeButton===!1?n.buttons=null:n.buttons=[{section:e.WidgetStdMod.HEADER,classNames:"closebutton",action:function(){this.hide()}}],l.superclass.constructor.apply(this,[n]),n.closeButton!==!1&&this.get("buttons").header[0].setAttribute("title",this.get("closeButtonTitle"))},e.extend(l,e.Panel,{_resizeevent:null,_orientationevent:null,_calculatedzindex:!1,initializer:function(){var t;this.get("render")&&!this.get("rendered")&&this.render(),this.makeResponsive(),this.after("visibleChange",this.visibilityChanged,this),this.get("center")&&this.centerDialogue(),this.get("modal")&&this.plug(e.M.core.LockScroll),t=this.get("boundingBox"),e.Array.each(this.get("extraClasses"),t.addClass,t),this.get("visible")&&this.applyZIndex(),this.on("maskShow",this.applyZIndex),this.get("visible")&&(this.show(),this.keyDelegation())},applyZIndex:function(){var t=1,n=1,r=this.get("boundingBox"),i=this.get("maskNode"),s=this.get("zIndex");s!==0&&!this._calculatedzindex?r.setStyle("zIndex",s):(e.all(p+", "+d+", "+v).each(function(e){var n=this.findZIndex(e);n>t&&(t=n)},this),n=(t+1).toString(),r.setStyle("zIndex",n),this.set("zIndex",n),this.get("modal")&&i.setStyle("zIndex",n),this._calculatedzindex=!0)},findZIndex:function(e){var t=e.getStyle("zIndex")||e.ancestor().getStyle("zIndex");return t?parseInt(t,10):0},visibilityChanged:function(t){var n,r;t.attrName==="visible"&&(this.get("maskNode").addClass(a.LIGHTBOX),t.prevVal&&!t.newVal&&(r=this.get("boundingBox"),this._resizeevent&&(this._resizeevent.detach(),this._resizeevent=null),this._orientationevent&&(this._orientationevent.detach(),this._orientationevent=null),r.detach("key",this.keyDelegation)),!t.prevVal&&t.newVal&&(this.applyZIndex(),this.makeResponsive(),this.shouldResizeFullscreen()||this.get("draggable")&&(n="#"+this.get("id")+" ."+a.HEADER,this.plug(e.Plugin.Drag,{handles:[n]}),e.one(n).setStyle("cursor","move")),this.keyDelegation()),this.get("center")&&!t.prevVal&&t.newVal&&this.centerDialogue())},makeResponsive:function(){var t=this.get("boundingBox"),n;this.shouldResizeFullscreen()?(t.addClass(c),t.setStyles({left:null,top:null,width:null,height:null,right:null,bottom:null}),n=e.one("#"+this.get("id")+" ."+a.BODY)):this.get("responsive")&&(t.removeClass(c).setStyles({width:this.get("width"),height:this.get("height")}),n=e.one("#"+this.get("id")+" ."+a.BODY))},centerDialogue:function(){var t=this.get("boundingBox"),n=t.hasClass(h),r,i;if(this.shouldResizeFullscreen())return;n&&t.setStyle("top","-1000px").removeClass(h),r=Math.max(Math.round((t.get("winWidth")-t.get("offsetWidth"))/2),15),i=Math.max(Math.round((t.get("winHeight")-t.get("offsetHeight"))/2),15)+e.one(window).get("scrollTop"),t.setStyles({left:r,top:i}),n&&t.addClass(h)},shouldResizeFullscreen:function(){return window===window.parent&&this.get("responsive")&&Math.floor(e.one(document.body).get("winWidth"))<this.get("responsiveWidth")},show:function(){var e=null,t=this.headerNode,n=this.bodyNode;return e=l.superclass.show.call(this),this.lockScroll&&this.lockScroll.enableScrollLock(this.shouldResizeFullscreen()),t&&t!==""?t.focus():n&&n!==""&&n.focus(),e},hide:function(e){if(e&&e.type==="key"&&e.keyCode===27&&!this.get("focused"))return;return this.lockScroll&&this.lockScroll.disableScrollLock(),l.superclass.hide.call(this,arguments)},keyDelegation:function(){var e=this.get("boundingBox");e.delegate("key",function(e){var t=e.target,n="forward";e.shiftKey&&(n="backward"),this.trapFocus(t,n)&&e.preventDefault()},"down:9",m,this)},trapFocus:function(e,t){var n=this.get("boundingBox"),r=n.one(m),i=n.all(m).pop();if(e===i&&t==="forward")return r.focus();if(e===r&&t==="backward")return i.focus()}},{NAME:f,CSS_PREFIX:n,ATTRS:{notificationBase:{},lightbox:{validator:e.Lang.isBoolean,value:!0},closeButton:{validator:e.Lang.isBoolean,value:!0},closeButtonTitle:{validator:e.Lang.isString,value:M.util.get_string("closebuttontitle","moodle")},center:{validator:e.Lang.isBoolean,value:!0},draggable:{validator:e.Lang.isBoolean,value:!1},COUNT:{value:null},responsive:{validator:e.Lang.isBoolean,value:!0},responsiveWidth:{value:768},extraClasses:{value:[]}}}),M.core.dialogue=l},"@VERSION@",{requires:["base","node","panel","escape","event-key","dd-plugin","moodle-core-lockscroll"]});
diff --git a/lib/yui/build/moodle-core-notification-dialogue/moodle-core-notification-dialogue.js b/lib/yui/build/moodle-core-notification-dialogue/moodle-core-notification-dialogue.js
index 836d3eab651..bda47c16651 100644
--- a/lib/yui/build/moodle-core-notification-dialogue/moodle-core-notification-dialogue.js
+++ b/lib/yui/build/moodle-core-notification-dialogue/moodle-core-notification-dialogue.js
@@ -529,4 +529,4 @@ Y.extend(DIALOGUE, Y.Panel, {
 M.core.dialogue = DIALOGUE;
 
 
-}, '@VERSION@', {"requires": ["base", "node", "panel", "event-key", "dd-plugin", "moodle-core-lockscroll"]});
+}, '@VERSION@', {"requires": ["base", "node", "panel", "escape", "event-key", "dd-plugin", "moodle-core-lockscroll"]});
diff --git a/lib/yui/build/moodle-core-notification-exception/moodle-core-notification-exception-debug.js b/lib/yui/build/moodle-core-notification-exception/moodle-core-notification-exception-debug.js
index 1ff144eb7ca..780a58e981a 100644
--- a/lib/yui/build/moodle-core-notification-exception/moodle-core-notification-exception-debug.js
+++ b/lib/yui/build/moodle-core-notification-exception/moodle-core-notification-exception-debug.js
@@ -75,13 +75,14 @@ Y.extend(EXCEPTION, M.core.dialogue, {
             delay = this.get('hideTimeoutDelay');
         this.get(BASE).addClass('moodle-dialogue-exception');
         this.setStdModContent(Y.WidgetStdMod.HEADER,
-                '<h1 id="moodle-dialogue-'+config.COUNT+'-header-text">' + config.name + '</h1>', Y.WidgetStdMod.REPLACE);
+                '<h1 id="moodle-dialogue-'+config.COUNT+'-header-text">' + Y.Escape.html(config.name) + '</h1>',
+                Y.WidgetStdMod.REPLACE);
         content = Y.Node.create('<div class="moodle-exception"></div>')
-                .append(Y.Node.create('<div class="moodle-exception-message">'+this.get('message')+'</div>'))
+                .append(Y.Node.create('<div class="moodle-exception-message">'+Y.Escape.html(this.get('message'))+'</div>'))
                 .append(Y.Node.create('<div class="moodle-exception-param hidden param-filename"><label>File:</label> ' +
-                        this.get('fileName')+'</div>'))
+                        Y.Escape.html(this.get('fileName'))+'</div>'))
                 .append(Y.Node.create('<div class="moodle-exception-param hidden param-linenumber"><label>Line:</label> ' +
-                        this.get('lineNumber')+'</div>'))
+                        Y.Escape.html(this.get('lineNumber'))+'</div>'))
                 .append(Y.Node.create('<div class="moodle-exception-param hidden param-stacktrace"><label>Stack trace:</label> <pre>' +
                         this.get('stack')+'</pre></div>'));
         if (M.cfg.developerdebug) {
@@ -163,7 +164,7 @@ Y.extend(EXCEPTION, M.core.dialogue, {
          */
         stack : {
             setter : function(str) {
-                var lines = str.split("\n"),
+                var lines = Y.Escape.html(str).split("\n"),
                     pattern = new RegExp('^(.+)@('+M.cfg.wwwroot+')?(.{0,75}).*:(\\d+)$'),
                     i;
                 for (i in lines) {
diff --git a/lib/yui/build/moodle-core-notification-exception/moodle-core-notification-exception-min.js b/lib/yui/build/moodle-core-notification-exception/moodle-core-notification-exception-min.js
index 44d504af71c..e4dcc4f9320 100644
--- a/lib/yui/build/moodle-core-notification-exception/moodle-core-notification-exception-min.js
+++ b/lib/yui/build/moodle-core-notification-exception/moodle-core-notification-exception-min.js
@@ -1 +1 @@
-YUI.add("moodle-core-notification-exception",function(e,t){var n,r,i,s,o,u,a;n="moodle-dialogue",r="notificationBase",i="yesLabel",s="noLabel",o="title",u="question",a={BASE:"moodle-dialogue-base",WRAP:"moodle-dialogue-wrap",HEADER:"moodle-dialogue-hd",BODY:"moodle-dialogue-bd",CONTENT:"moodle-dialogue-content",FOOTER:"moodle-dialogue-ft",HIDDEN:"hidden",LIGHTBOX:"moodle-dialogue-lightbox"},M.core=M.core||{};var f="Moodle exception",l;l=function(t){var n=e.mix({},t);n.width=n.width||M.cfg.developerdebug?Math.floor(e.one(document.body).get("winWidth")/3)+"px":null,n.closeButton=!0;var r=["message","name","fileName","lineNumber","stack"];e.Array.each(r,function(e){n[e]=t[e]}),l.superclass.constructor.apply(this,[n])},e.extend(l,M.core.dialogue,{_hideTimeout:null,_keypress:null,initializer:function(t){var n,i=this,s=this.get("hideTimeoutDelay");this.get(r).addClass("moodle-dialogue-exception"),this.setStdModContent(e.WidgetStdMod.HEADER,'<h1 id="moodle-dialogue-'+t.COUNT+'-header-text">'+t.name+"</h1>",e.WidgetStdMod.REPLACE),n=e.Node.create('<div class="moodle-exception"></div>').append(e.Node.create('<div class="moodle-exception-message">'+this.get("message")+"</div>")).append(e.Node.create('<div class="moodle-exception-param hidden param-filename"><label>File:</label> '+this.get("fileName")+"</div>")).append(e.Node.create('<div class="moodle-exception-param hidden param-linenumber"><label>Line:</label> '+this.get("lineNumber")+"</div>")).append(e.Node.create('<div class="moodle-exception-param hidden param-stacktrace"><label>Stack trace:</label> <pre>'+this.get("stack")+"</pre></div>")),M.cfg.developerdebug&&n.all(".moodle-exception-param").removeClass("hidden"),this.setStdModContent(e.WidgetStdMod.BODY,n,e.WidgetStdMod.REPLACE),s&&(this._hideTimeout=setTimeout(function(){i.hide()},s)),this.after("visibleChange",this.visibilityChanged,this),this.after("destroyedChange",function(){this.get(r).remove()},this),this._keypress=e.on("key",this.hide,window,"down:13,27",this),this.centerDialogue()},visibilityChanged:function(e){if(e.attrName==="visible"&&e.prevVal&&!e.newVal){this._keypress&&this._keypress.detach();var t=this;setTimeout(function(){t.destroy()},1e3)}}},{NAME:f,CSS_PREFIX:n,ATTRS:{message:{value:""},name:{value:""},fileName:{value:""},lineNumber:{value:""},stack:{setter:function(e){var t=e.split("\n"),n=new RegExp("^(.+)@("+M.cfg.wwwroot+")?(.{0,75}).*:(\\d+)$"),r;for(r in t)t[r]=t[r].replace(n,"<div class='stacktrace-line'>ln: $4</div><div class='stacktrace-file'>$3</div><div class='stacktrace-call'>$1</div>");return t.join("")},value:""},hideTimeoutDelay:{validator:e.Lang.isNumber,value:null}}}),M.core.exception=l},"@VERSION@",{requires:["moodle-core-notification-dialogue"]});
+YUI.add("moodle-core-notification-exception",function(e,t){var n,r,i,s,o,u,a;n="moodle-dialogue",r="notificationBase",i="yesLabel",s="noLabel",o="title",u="question",a={BASE:"moodle-dialogue-base",WRAP:"moodle-dialogue-wrap",HEADER:"moodle-dialogue-hd",BODY:"moodle-dialogue-bd",CONTENT:"moodle-dialogue-content",FOOTER:"moodle-dialogue-ft",HIDDEN:"hidden",LIGHTBOX:"moodle-dialogue-lightbox"},M.core=M.core||{};var f="Moodle exception",l;l=function(t){var n=e.mix({},t);n.width=n.width||M.cfg.developerdebug?Math.floor(e.one(document.body).get("winWidth")/3)+"px":null,n.closeButton=!0;var r=["message","name","fileName","lineNumber","stack"];e.Array.each(r,function(e){n[e]=t[e]}),l.superclass.constructor.apply(this,[n])},e.extend(l,M.core.dialogue,{_hideTimeout:null,_keypress:null,initializer:function(t){var n,i=this,s=this.get("hideTimeoutDelay");this.get(r).addClass("moodle-dialogue-exception"),this.setStdModContent(e.WidgetStdMod.HEADER,'<h1 id="moodle-dialogue-'+t.COUNT+'-header-text">'+e.Escape.html(t.name)+"</h1>",e.WidgetStdMod.REPLACE),n=e.Node.create('<div class="moodle-exception"></div>').append(e.Node.create('<div class="moodle-exception-message">'+e.Escape.html(this.get("message"))+"</div>")).append(e.Node.create('<div class="moodle-exception-param hidden param-filename"><label>File:</label> '+e.Escape.html(this.get("fileName"))+"</div>")).append(e.Node.create('<div class="moodle-exception-param hidden param-linenumber"><label>Line:</label> '+e.Escape.html(this.get("lineNumber"))+"</div>")).append(e.Node.create('<div class="moodle-exception-param hidden param-stacktrace"><label>Stack trace:</label> <pre>'+this.get("stack")+"</pre></div>")),M.cfg.developerdebug&&n.all(".moodle-exception-param").removeClass("hidden"),this.setStdModContent(e.WidgetStdMod.BODY,n,e.WidgetStdMod.REPLACE),s&&(this._hideTimeout=setTimeout(function(){i.hide()},s)),this.after("visibleChange",this.visibilityChanged,this),this.after("destroyedChange",function(){this.get(r).remove()},this),this._keypress=e.on("key",this.hide,window,"down:13,27",this),this.centerDialogue()},visibilityChanged:function(e){if(e.attrName==="visible"&&e.prevVal&&!e.newVal){this._keypress&&this._keypress.detach();var t=this;setTimeout(function(){t.destroy()},1e3)}}},{NAME:f,CSS_PREFIX:n,ATTRS:{message:{value:""},name:{value:""},fileName:{value:""},lineNumber:{value:""},stack:{setter:function(t){var n=e.Escape.html(t).split("\n"),r=new RegExp("^(.+)@("+M.cfg.wwwroot+")?(.{0,75}).*:(\\d+)$"),i;for(i in n)n[i]=n[i].replace(r,"<div class='stacktrace-line'>ln: $4</div><div class='stacktrace-file'>$3</div><div class='stacktrace-call'>$1</div>");return n.join("")},value:""},hideTimeoutDelay:{validator:e.Lang.isNumber,value:null}}}),M.core.exception=l},"@VERSION@",{requires:["moodle-core-notification-dialogue"]});
diff --git a/lib/yui/build/moodle-core-notification-exception/moodle-core-notification-exception.js b/lib/yui/build/moodle-core-notification-exception/moodle-core-notification-exception.js
index 1ff144eb7ca..780a58e981a 100644
--- a/lib/yui/build/moodle-core-notification-exception/moodle-core-notification-exception.js
+++ b/lib/yui/build/moodle-core-notification-exception/moodle-core-notification-exception.js
@@ -75,13 +75,14 @@ Y.extend(EXCEPTION, M.core.dialogue, {
             delay = this.get('hideTimeoutDelay');
         this.get(BASE).addClass('moodle-dialogue-exception');
         this.setStdModContent(Y.WidgetStdMod.HEADER,
-                '<h1 id="moodle-dialogue-'+config.COUNT+'-header-text">' + config.name + '</h1>', Y.WidgetStdMod.REPLACE);
+                '<h1 id="moodle-dialogue-'+config.COUNT+'-header-text">' + Y.Escape.html(config.name) + '</h1>',
+                Y.WidgetStdMod.REPLACE);
         content = Y.Node.create('<div class="moodle-exception"></div>')
-                .append(Y.Node.create('<div class="moodle-exception-message">'+this.get('message')+'</div>'))
+                .append(Y.Node.create('<div class="moodle-exception-message">'+Y.Escape.html(this.get('message'))+'</div>'))
                 .append(Y.Node.create('<div class="moodle-exception-param hidden param-filename"><label>File:</label> ' +
-                        this.get('fileName')+'</div>'))
+                        Y.Escape.html(this.get('fileName'))+'</div>'))
                 .append(Y.Node.create('<div class="moodle-exception-param hidden param-linenumber"><label>Line:</label> ' +
-                        this.get('lineNumber')+'</div>'))
+                        Y.Escape.html(this.get('lineNumber'))+'</div>'))
                 .append(Y.Node.create('<div class="moodle-exception-param hidden param-stacktrace"><label>Stack trace:</label> <pre>' +
                         this.get('stack')+'</pre></div>'));
         if (M.cfg.developerdebug) {
@@ -163,7 +164,7 @@ Y.extend(EXCEPTION, M.core.dialogue, {
          */
         stack : {
             setter : function(str) {
-                var lines = str.split("\n"),
+                var lines = Y.Escape.html(str).split("\n"),
                     pattern = new RegExp('^(.+)@('+M.cfg.wwwroot+')?(.{0,75}).*:(\\d+)$'),
                     i;
                 for (i in lines) {
diff --git a/lib/yui/src/notification/js/ajaxexception.js b/lib/yui/src/notification/js/ajaxexception.js
index 08a55302033..b8e7d67f6d8 100644
--- a/lib/yui/src/notification/js/ajaxexception.js
+++ b/lib/yui/src/notification/js/ajaxexception.js
@@ -30,15 +30,16 @@ Y.extend(AJAXEXCEPTION, M.core.dialogue, {
             delay = this.get('hideTimeoutDelay');
         this.get(BASE).addClass('moodle-dialogue-exception');
         this.setStdModContent(Y.WidgetStdMod.HEADER,
-                '<h1 id="moodle-dialogue-'+this.get('COUNT')+'-header-text">' + config.name + '</h1>', Y.WidgetStdMod.REPLACE);
+                '<h1 id="moodle-dialogue-'+this.get('COUNT')+'-header-text">' + Y.Escape.html(config.name) + '</h1>',
+                Y.WidgetStdMod.REPLACE);
         content = Y.Node.create('<div class="moodle-ajaxexception"></div>')
-                .append(Y.Node.create('<div class="moodle-exception-message">'+this.get('error')+'</div>'))
+                .append(Y.Node.create('<div class="moodle-exception-message">'+Y.Escape.html(this.get('error'))+'</div>'))
                 .append(Y.Node.create('<div class="moodle-exception-param hidden param-debuginfo"><label>URL:</label> ' +
                         this.get('reproductionlink')+'</div>'))
                 .append(Y.Node.create('<div class="moodle-exception-param hidden param-debuginfo"><label>Debug info:</label> ' +
-                        this.get('debuginfo')+'</div>'))
+                        Y.Escape.html(this.get('debuginfo'))+'</div>'))
                 .append(Y.Node.create('<div class="moodle-exception-param hidden param-stacktrace"><label>Stack trace:</label> <pre>' +
-                        this.get('stacktrace')+'</pre></div>'));
+                        Y.Escape.html(this.get('stacktrace'))+'</pre></div>'));
         if (M.cfg.developerdebug) {
             content.all('.moodle-exception-param').removeClass('hidden');
         }
@@ -111,6 +112,7 @@ Y.extend(AJAXEXCEPTION, M.core.dialogue, {
         reproductionlink : {
             setter : function(link) {
                 if (link !== null) {
+                    link = Y.Escape.html(link);
                     link = '<a href="'+link+'">'+link.replace(M.cfg.wwwroot, '')+'</a>';
                 }
                 return link;
diff --git a/lib/yui/src/notification/js/exception.js b/lib/yui/src/notification/js/exception.js
index ea8f4a5fe3f..609a2c81f4b 100644
--- a/lib/yui/src/notification/js/exception.js
+++ b/lib/yui/src/notification/js/exception.js
@@ -46,13 +46,14 @@ Y.extend(EXCEPTION, M.core.dialogue, {
             delay = this.get('hideTimeoutDelay');
         this.get(BASE).addClass('moodle-dialogue-exception');
         this.setStdModContent(Y.WidgetStdMod.HEADER,
-                '<h1 id="moodle-dialogue-'+config.COUNT+'-header-text">' + config.name + '</h1>', Y.WidgetStdMod.REPLACE);
+                '<h1 id="moodle-dialogue-'+config.COUNT+'-header-text">' + Y.Escape.html(config.name) + '</h1>',
+                Y.WidgetStdMod.REPLACE);
         content = Y.Node.create('<div class="moodle-exception"></div>')
-                .append(Y.Node.create('<div class="moodle-exception-message">'+this.get('message')+'</div>'))
+                .append(Y.Node.create('<div class="moodle-exception-message">'+Y.Escape.html(this.get('message'))+'</div>'))
                 .append(Y.Node.create('<div class="moodle-exception-param hidden param-filename"><label>File:</label> ' +
-                        this.get('fileName')+'</div>'))
+                        Y.Escape.html(this.get('fileName'))+'</div>'))
                 .append(Y.Node.create('<div class="moodle-exception-param hidden param-linenumber"><label>Line:</label> ' +
-                        this.get('lineNumber')+'</div>'))
+                        Y.Escape.html(this.get('lineNumber'))+'</div>'))
                 .append(Y.Node.create('<div class="moodle-exception-param hidden param-stacktrace"><label>Stack trace:</label> <pre>' +
                         this.get('stack')+'</pre></div>'));
         if (M.cfg.developerdebug) {
@@ -134,7 +135,7 @@ Y.extend(EXCEPTION, M.core.dialogue, {
          */
         stack : {
             setter : function(str) {
-                var lines = str.split("\n"),
+                var lines = Y.Escape.html(str).split("\n"),
                     pattern = new RegExp('^(.+)@('+M.cfg.wwwroot+')?(.{0,75}).*:(\\d+)$'),
                     i;
                 for (i in lines) {
diff --git a/lib/yui/src/notification/meta/notification.json b/lib/yui/src/notification/meta/notification.json
index c3c0bfe16fb..74d36c32f31 100644
--- a/lib/yui/src/notification/meta/notification.json
+++ b/lib/yui/src/notification/meta/notification.json
@@ -13,6 +13,7 @@
         "base",
         "node",
         "panel",
+        "escape",
         "event-key",
         "dd-plugin",
         "moodle-core-lockscroll"