L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-80239 grade: escape matched data in user search results.

Browse Source
This commit is contained in:
Paul Holden
2023-12-07 08:42:38 +08:00
committed by Ilya Tregubov
parent 260924aeb8
commit 463f16617e
3 changed files with 15 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
user/amd/build/comboboxsearch/user.min.js
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
user/amd/build/comboboxsearch/user.min.js.map
+1 -1
View File
File diff suppressed because one or more lines are too long
user/amd/src/comboboxsearch/user.js
+13 -5
View File
@@ -140,15 +140,23 @@ export default class UserSearch extends search_combobox {
if (value === null) {
continue;
}
const valueString = value.toString().toLowerCase();
if (valueString.includes(this.getPreppedSearchTerm()) && !this.bannedFilterFields.includes(key)) {
const preppedSearchTerm = this.getPreppedSearchTerm();
const searchTerm = this.getSearchTerm();
if (valueString.includes(preppedSearchTerm) && !this.bannedFilterFields.includes(key)) {
// Ensure we have a good string, otherwise fallback to the key.
user.matchingFieldName = stringMap.get(key) ?? key;
user.matchingField = valueString.replace(
this.getPreppedSearchTerm(),
`<span class="font-weight-bold">${this.getSearchTerm()}</span>`
// Safely prepare our matching results.
const escapedValueString = valueString.replace(/</g, '&lt;');
const escapedMatchingField = escapedValueString.replace(
preppedSearchTerm.replace(/</g, '&lt;'),
`<span class="font-weight-bold">${searchTerm.replace(/</g, '&lt;')}</span>`
);
user.matchingField = `${user.matchingField} (${user.email})`;
user.matchingField = `${escapedMatchingField} (${user.email})`;
user.link = this.selectOneLink(user.id);
break;
}