manual grading: MDL-20581 Fix potential XSS problem.

Thanks to Penny for spotting this.

mod/quiz/db/access.php

@@ -65,7 +65,7 @@ $mod_quiz_capabilities = array(
 
     // Manually grade and comment on student attempts at a question, and regrade quizzes.
     'mod/quiz:grade' => array(
-        'riskbitmask' => RISK_SPAM | RISK_XSS,
+        'riskbitmask' => RISK_SPAM,
         'captype' => 'write',
         'contextlevel' => CONTEXT_MODULE,
         'legacy' => array(

question/type/questiontype.php

@@ -874,7 +874,10 @@ class default_questiontype {
             $grade .= $question->maxgrade;
         }
 
-        $comment = stripslashes($state->manualcomment);
+        $formatoptions = new stdClass;
+        $formatoptions->para = false;
+        $comment = format_text(stripslashes($state->manualcomment), FORMAT_HTML,
+                $formatoptions, $cmoptions->course);
         $commentlink = '';
 
         if (!empty($options->questioncommentlink)) {