From a1ccc146ac16cbf87cd82b9f0a41e4196d425652 Mon Sep 17 00:00:00 2001 From: Rajesh Taneja Date: Tue, 11 Dec 2012 16:50:30 +0800 Subject: [PATCH] MDL-37015 Resource: link in onclick should not contain html special char --- course/lib.php | 5 +++-- lib/navigationlib.php | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/course/lib.php b/course/lib.php index 1e81de9d079..eab9984d37f 100644 --- a/course/lib.php +++ b/course/lib.php @@ -1516,8 +1516,9 @@ function print_section($course, $section, $mods, $modnamesused, $absolute=false, $textcss = ''; } - // Get on-click attribute value if specified - $onclick = $mod->get_on_click(); + // Get on-click attribute value if specified and decode the onclick - it + // has already been encoded for display (puke). + $onclick = htmlspecialchars_decode($mod->get_on_click(), ENT_QUOTES); $groupinglabel = ''; if (!empty($mod->groupingid) && has_capability('moodle/course:managegroups', context_course::instance($course->id))) { diff --git a/lib/navigationlib.php b/lib/navigationlib.php index b4e69c6557c..d5618c6a439 100644 --- a/lib/navigationlib.php +++ b/lib/navigationlib.php @@ -1922,7 +1922,7 @@ class global_navigation extends navigation_node { $propogrationhandler = 'e.halt();'; } // Decode the onclick - it has already been encoded for display (puke) - $onclick = htmlspecialchars_decode($activity->onclick); + $onclick = htmlspecialchars_decode($activity->onclick, ENT_QUOTES); // Build the JS function the click event will call $jscode = "function {$functionname}(e) { $propogrationhandler $onclick }"; $this->page->requires->js_init_code($jscode);