manual grading: MDL-20581 Fix potential XSS problem.

Thanks to Penny for spotting this. Merged from MOODLE_19_STABLE.
2009-11-19 17:31:41 +00:00
parent 2d0d78befd
commit 5ffd1421a5
3 changed files with 7 additions and 4 deletions
@@ -946,7 +946,10 @@ class default_questiontype {
            $grade .= question_format_grade($cmoptions, $question->maxgrade);
        }

-        $comment = $state->manualcomment;
+        $formatoptions = new stdClass;
+        $formatoptions->para = false;
+        $comment = format_text($state->manualcomment, FORMAT_HTML,
+                $formatoptions, $cmoptions->course);
        $commentlink = '';

        if (!empty($options->questioncommentlink)) {