MDL-65552 user: escape idnumber and email in table_sql

admin/tool/policy/classes/acceptances_table.php

@@ -641,6 +641,6 @@ class acceptances_table extends \table_sql {
             }
             return ''; // User agreed by themselves.
         }
-        return null;
+        return parent::other_cols($column, $row);
     }
 }

lib/tablelib.php

@@ -841,6 +841,12 @@ class flexible_table {
      * build_table which calls this method.
      */
     function other_cols($column, $row) {
+        if (isset($row->$column) && ($column === 'email' || $column === 'idnumber') &&
+                (!$this->is_downloading() || $this->export_class_instance()->supports_html())) {
+            // Columns email and idnumber may potentially contain malicious characters, escape them by default.
+            // This function will not be executed if the child class implements col_email() or col_idnumber().
+            return s($row->$column);
+        }
         return NULL;
     }
 

mod/assign/gradingtable.php

@@ -1472,7 +1472,7 @@ class assign_grading_table extends table_sql implements renderable {
     public function other_cols($colname, $row) {
         // For extra user fields the result is already in $row.
         if (empty($this->plugincache[$colname])) {
-            return $row->$colname;
+            return parent::other_cols($colname, $row);
         }
 
         // This must be a plugin field.

mod/feedback/classes/responses_table.php

@@ -200,7 +200,7 @@ class mod_feedback_responses_table extends table_sql {
             }
             return trim($printval);
         }
-        return $row->$column;
+        return parent::other_cols($column, $row);
     }
 
     /**

mod/quiz/report/overview/overview_table.php

@@ -273,7 +273,7 @@ class quiz_overview_table extends quiz_attempts_report_table {
      */
     public function other_cols($colname, $attempt) {
         if (!preg_match('/^qsgrade(\d+)$/', $colname, $matches)) {
-            return null;
+            return parent::other_cols($colname, $attempt);
         }
         $slot = $matches[1];
 

mod/quiz/report/responses/last_responses_table.php

@@ -128,7 +128,7 @@ class quiz_last_responses_table extends quiz_attempts_report_table {
             return $this->data_col($matches[1], 'rightanswer', $attempt);
 
         } else {
-            return null;
+            return parent::other_cols($colname, $attempt);
         }
     }