From 178af4770e250504a307e5985158d039c15c1026 Mon Sep 17 00:00:00 2001
From: "Eloy Lafuente (stronk7)" <stronk7@moodle.org>
Date: Fri, 6 Sep 2013 11:20:19 +0200
Subject: [PATCH 1/3] MDL-41623 ensure all links are valid urls

For 23 and 24 we are modifying the default Sanitizer. Note that
for 24 and upwards we are doing the same with our extended
Sanitizer. So this is just an interim hack for those old versions.
---
 lib/simplepie/readme_moodle.txt   | 2 ++
 lib/simplepie/simplepie.class.php | 4 ++++
 2 files changed, 6 insertions(+)

diff --git a/lib/simplepie/readme_moodle.txt b/lib/simplepie/readme_moodle.txt
index 28bfa762799..578068837fc 100644
--- a/lib/simplepie/readme_moodle.txt
+++ b/lib/simplepie/readme_moodle.txt
@@ -5,6 +5,8 @@ Obtained from http://github.com/simplepie/simplepie/commit/798f4674468316b8cc70f
 Changes:
   * None. This import contains _NO_CHANGES_ to the simplepie.inc file, changes are
     controlled through OO extension of the classes instead.
+  * Exception: The Sanitizer has been modified to return valid URLs. The change
+    is done through OO extension in 25 and upwards but not in 23 and 24.
 
 Dan Poltawski <talktodan@gmail.com>
 Petr Skoda
diff --git a/lib/simplepie/simplepie.class.php b/lib/simplepie/simplepie.class.php
index 2aeb1ff569e..161cdc7143b 100644
--- a/lib/simplepie/simplepie.class.php
+++ b/lib/simplepie/simplepie.class.php
@@ -14466,6 +14466,10 @@ class SimplePie_Sanitize
 			if ($type & SIMPLEPIE_CONSTRUCT_IRI)
 			{
 				$data = SimplePie_Misc::absolutize_url($data, $base);
+				// Moodle modification - Only return valid URLs. Note this change is interim and
+				// 2.5 and upwards have the cleaning performed in our own sanitizer.
+				$data = clean_param($data, PARAM_URL);
+				// End of Moodle modification.
 			}
 
 			if ($type & (SIMPLEPIE_CONSTRUCT_TEXT | SIMPLEPIE_CONSTRUCT_IRI))

From 39616d39c4a65296ea98e29e0ff22bc6d9ca8ba4 Mon Sep 17 00:00:00 2001
From: Dan Poltawski <dan@moodle.com>
Date: Sat, 7 Sep 2013 09:45:07 +0800
Subject: [PATCH 2/3] MDL-41623 rss: clean output rss content

---
 blocks/rss_client/viewfeed.php |  7 ++++---
 blog/renderer.php              | 11 +++++++----
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/blocks/rss_client/viewfeed.php b/blocks/rss_client/viewfeed.php
index 1c287d703c5..26451d6b742 100644
--- a/blocks/rss_client/viewfeed.php
+++ b/blocks/rss_client/viewfeed.php
@@ -84,15 +84,16 @@ if (!empty($rssrecord->preferredtitle)) {
     $feedtitle =  $rss->get_title();
 }
 echo '<table align="center" width="50%" cellspacing="1">'."\n";
-echo '<tr><td colspan="2"><strong>'. $feedtitle .'</strong></td></tr>'."\n";
+echo '<tr><td colspan="2"><strong>'. s($feedtitle) .'</strong></td></tr>'."\n";
 foreach ($rss->get_items() as $item) {
     echo '<tr><td valign="middle">'."\n";
-    echo '<a href="'. $item->get_link() .'" target="_blank"><strong>'. $item->get_title();
+    echo '<a href="'.$item->get_link().'" target="_blank"><strong>';
+    echo s($item->get_title());
     echo '</strong></a>'."\n";
     echo '</td>'."\n";
     echo '</tr>'."\n";
     echo '<tr><td colspan="2"><small>';
-    echo $item->get_description() .'</small></td></tr>'."\n";
+    echo format_text($item->get_description(), FORMAT_HTML) .'</small></td></tr>'."\n";
 }
 echo '</table>'."\n";
 
diff --git a/blog/renderer.php b/blog/renderer.php
index b605016d10e..af1724de1ab 100644
--- a/blog/renderer.php
+++ b/blog/renderer.php
@@ -119,11 +119,14 @@ class core_blog_renderer extends plugin_renderer_base {
         // Body.
         $o .= format_text($entry->summary, $entry->summaryformat, array('overflowdiv' => true));
 
-        // Uniquehash is used as a link to an external blog.
         if (!empty($entry->uniquehash)) {
-            $o .= $this->output->container_start('externalblog');
-            $o .= html_writer::link($entry->uniquehash, get_string('linktooriginalentry', 'blog'));
-            $o .= $this->output->container_end();
+            // Uniquehash is used as a link to an external blog.
+            $url = clean_param($entry->uniquehash, PARAM_URL);
+            if (!empty($url)) {
+                $o .= $this->output->container_start('externalblog');
+                $o .= html_writer::link($url, get_string('linktooriginalentry', 'blog'));
+                $o .= $this->output->container_end();
+            }
         }
 
         // Links to tags.

From 28980dbee60be657620a6e57fc37c962bcfb8285 Mon Sep 17 00:00:00 2001
From: "Eloy Lafuente (stronk7)" <stronk7@moodle.org>
Date: Sat, 7 Sep 2013 14:25:39 +0200
Subject: [PATCH 3/3] Moodle release 2.4.6

---
 version.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/version.php b/version.php
index 31ce846d4ee..72d930a39f1 100644
--- a/version.php
+++ b/version.php
@@ -29,11 +29,11 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$version  = 2012120305.13;              // 20121203      = branching date YYYYMMDD - do not modify!
+$version  = 2012120306.00;              // 20121203      = branching date YYYYMMDD - do not modify!
                                         //         RR    = release increments - 00 in DEV branches
                                         //           .XX = incremental changes
 
-$release  = '2.4.5+ (Build: 20130905)';  // Human-friendly version name
+$release  = '2.4.6 (Build: 20130909)';  // Human-friendly version name
 
 $branch   = '24';                       // this version's branch
 $maturity = MATURITY_STABLE;            // this version's maturity level