L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-56252 message: clean message text in message area

Browse Source 
Remove the HTML tags from any message in the message area when updating
the last message on the contact otherwise the styling breaks and also
allows <script> tags to be added to the page.
This commit is contained in:
Ryan Wyllie
2016-10-20 06:49:26 +00:00
parent 6a69cda97d
commit 54d83992b4
6 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
message/classes/helper.php
+2 -1
View File
@@ -147,7 +147,8 @@ class helper {
$data->messageid = null;
if (isset($contact->smallmessage)) {
$data->ismessaging = true;
$data->lastmessage = $contact->smallmessage;
// Strip the HTML tags from the message for displaying in the contact area.
$data->lastmessage = clean_param($contact->smallmessage, PARAM_NOTAGS);
$data->useridfrom = $contact->useridfrom;
if (isset($contact->messageid)) {
$data->messageid = $contact->messageid;