From 5b8ca7ac93ff3e72e0ddc438270d9502023f7d11 Mon Sep 17 00:00:00 2001 From: Marina Glancy Date: Fri, 16 Jun 2017 09:02:01 +0800 Subject: [PATCH] MDL-59136 roles: avoid double escaping in role names --- course/switchrole.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/course/switchrole.php b/course/switchrole.php index 4b5009032d8..b4840f9560f 100644 --- a/course/switchrole.php +++ b/course/switchrole.php @@ -101,7 +101,8 @@ if ($switchrole > 0 && has_capability('moodle/role:switchroles', $context)) { foreach ($roles as $key => $role) { $url = new moodle_url('/course/switchrole.php', array('id' => $id, 'switchrole' => $key, 'returnurl' => $returnurl)); - echo $OUTPUT->container($OUTPUT->single_button($url, $role), 'm-x-3 m-b-1'); + // Button encodes special characters, apply htmlspecialchars_decode() to avoid double escaping. + echo $OUTPUT->container($OUTPUT->single_button($url, htmlspecialchars_decode($role)), 'm-x-3 m-b-1'); } $url = new moodle_url($returnurl);