From d50a9a9d30ae324c465e533d34ae705897817228 Mon Sep 17 00:00:00 2001
From: Nigel Cunningham <nigelc@catalyst-au.net>
Date: Mon, 2 May 2016 15:13:20 +1000
Subject: [PATCH 1/2] MDL-54010 roles: Fix missing HTMLspecialchars in role
 export code.

Role name and description fields are currently not escaped when
exporting a role. This results in an unusable file when characters
such as ampersands are used in a name or description. Fix this by
using htmlspecialchars on both fields.

Signed-off-by: Nigel Cunningham <nigelc@catalyst-au.net>
---
 admin/roles/classes/preset.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/admin/roles/classes/preset.php b/admin/roles/classes/preset.php
index 85904eb126a..45a68a7bfcf 100644
--- a/admin/roles/classes/preset.php
+++ b/admin/roles/classes/preset.php
@@ -71,8 +71,8 @@ class core_role_preset {
         $dom->appendChild($top);
 
         $top->appendChild($dom->createElement('shortname', $role->shortname));
-        $top->appendChild($dom->createElement('name', $role->name));
-        $top->appendChild($dom->createElement('description', $role->description));
+        $top->appendChild($dom->createElement('name', htmlspecialchars($role->name)));
+        $top->appendChild($dom->createElement('description', htmlspecialchars($role->description)));
         $top->appendChild($dom->createElement('archetype', $role->archetype));
 
         $contextlevels = $dom->createElement('contextlevels');

From bb30944f49dc771baa5cb27e9f6d442b388ddd11 Mon Sep 17 00:00:00 2001
From: Cameron Ball <cameron@moodle.com>
Date: Wed, 25 May 2016 12:50:18 +0800
Subject: [PATCH 2/2] MDL-54010 roles: Specify encoding for escaped export data

---
 admin/roles/classes/preset.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/admin/roles/classes/preset.php b/admin/roles/classes/preset.php
index 45a68a7bfcf..256f635d5ba 100644
--- a/admin/roles/classes/preset.php
+++ b/admin/roles/classes/preset.php
@@ -71,8 +71,9 @@ class core_role_preset {
         $dom->appendChild($top);
 
         $top->appendChild($dom->createElement('shortname', $role->shortname));
-        $top->appendChild($dom->createElement('name', htmlspecialchars($role->name)));
-        $top->appendChild($dom->createElement('description', htmlspecialchars($role->description)));
+        $top->appendChild($dom->createElement('name', htmlspecialchars($role->name, ENT_COMPAT | ENT_HTML401, 'UTF-8')));
+        $top->appendChild($dom->createElement('description', htmlspecialchars($role->description, ENT_COMPAT | ENT_HTML401,
+                'UTF-8')));
         $top->appendChild($dom->createElement('archetype', $role->archetype));
 
         $contextlevels = $dom->createElement('contextlevels');