MDL-61196 message_popup: clean params before returning via WS

2018-02-09 17:37:16 +08:00
parent 091b2fad14
commit 2f2d7e6358
1 changed files with 4 additions and 0 deletions
@@ -70,6 +70,10 @@ class popup_notification implements templatable, renderable {
        $context->timecreatedpretty = get_string('ago', 'message', format_time(time() - $context->timecreated));
        $context->text = message_format_message_text($context);
        $context->read = $context->timeread ? true : false;
+
+        // Need to strip any HTML from these.
+        $context->subject = clean_param($context->subject, PARAM_TEXT);
+        $context->contexturlname = clean_param($context->contexturlname, PARAM_TEXT);
        $context->shortenedsubject = shorten_text($context->subject, 125);

        if (!empty($context->component) && substr($context->component, 0, 4) == 'mod_') {