From 2e057f082d622b09a33fd32aff3b4d275aed04dc Mon Sep 17 00:00:00 2001
From: Michael Hawkins <michaelh@moodle.com>
Date: Tue, 11 Dec 2018 14:27:13 +0800
Subject: [PATCH] MDL-64372 userpix: Escape fullname string on userpix index
 page

---
 userpix/index.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/userpix/index.php b/userpix/index.php
index 515957116ad..dedef09d006 100644
--- a/userpix/index.php
+++ b/userpix/index.php
@@ -25,7 +25,7 @@ echo $OUTPUT->header();
 
 $rs = $DB->get_recordset_select("user", "deleted = 0 AND picture > 0", array(), "lastaccess DESC", user_picture::fields());
 foreach ($rs as $user) {
-    $fullname = fullname($user);
+    $fullname = s(fullname($user));
     echo "<a href=\"$CFG->wwwroot/user/view.php?id=$user->id&amp;course=1\" ".
          "title=\"$fullname\">";
     echo $OUTPUT->user_picture($user);