From af2a1e4e3386151ed35dc7f51e3100db77cc2400 Mon Sep 17 00:00:00 2001
From: Frederic Massart <fred@moodle.com>
Date: Fri, 4 Jul 2014 11:48:39 +0800
Subject: [PATCH] MDL-45596 roles: Escape filter value before using it in form
 field

---
 admin/roles/classes/capability_table_base.php | 12 ++++++++++--
 admin/roles/module.js                         |  2 +-
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/admin/roles/classes/capability_table_base.php b/admin/roles/classes/capability_table_base.php
index 11cadee722a..b46c137e264 100644
--- a/admin/roles/classes/capability_table_base.php
+++ b/admin/roles/classes/capability_table_base.php
@@ -74,8 +74,16 @@ abstract class core_role_capability_table_base {
     public function display() {
         if (count($this->capabilities) > self::NUM_CAPS_FOR_SEARCH) {
             global $PAGE;
-            $PAGE->requires->strings_for_js(array('filter', 'clear'), 'moodle');
-            $PAGE->requires->js_init_call('M.core_role.init_cap_table_filter', array($this->id, $this->context->id));
+            $jsmodule = array(
+                'name' => 'rolescapfilter',
+                'fullpath' => '/admin/roles/module.js',
+                'strings' => array(
+                    array('filter', 'moodle'),
+                    array('clear', 'moodle'),                ),
+                'requires' => array('node', 'cookie', 'escape')
+            );
+            $PAGE->requires->js_init_call('M.core_role.init_cap_table_filter', array($this->id, $this->context->id), false,
+                $jsmodule);
         }
         echo '<table class="' . implode(' ', $this->classes) . '" id="' . $this->id . '">' . "\n<thead>\n";
         echo '<tr><th class="name" align="left" scope="col">' . get_string('capability', 'core_role') . '</th>';
diff --git a/admin/roles/module.js b/admin/roles/module.js
index 7326cf34252..0cac01ad1a8 100644
--- a/admin/roles/module.js
+++ b/admin/roles/module.js
@@ -51,7 +51,7 @@ M.core_role.init_cap_table_filter = function(Y, tableid, contextid) {
                 marginRight : 'auto'
             });
             // Create the capability search input.
-            this.input = Y.Node.create('<input type="text" id="'+this.table.get('id')+'capabilitysearch" value="'+filtervalue+'" />');
+            this.input = Y.Node.create('<input type="text" id="'+this.table.get('id')+'capabilitysearch" value="'+Y.Escape.html(filtervalue)+'" />');
             // Create a label for the search input.
             this.label = Y.Node.create('<label for="'+this.input.get('id')+'">'+M.str.moodle.filter+' </label>');
             // Create a clear button to clear the input.