MDL-41820 XSS in the quiz responses report.

Thanks to Michael Hess for finding this bug and reporting it to us.
2013-11-04 11:10:30 +08:00
parent 919efdf632
commit 6917b452bf
1 changed files with 5 additions and 0 deletions
@@ -97,6 +97,11 @@ class quiz_responses_table extends quiz_attempts_report_table {
            $summary = trim($stepdata->$field);
        }

+        if ($this->is_downloading() && $this->is_downloading() != 'xhtml') {
+            return $summary;
+        }
+        $summary = s($summary);
+
        if ($this->is_downloading() || $field != 'responsesummary') {
            return $summary;
        }