L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-65552 user: escape idnumber field on output.

Browse Source 
This commit also corrects parameter definition of the field to
match core_user.
This commit is contained in:
Paul Holden
2021-03-03 23:14:37 +08:00
committed by Jun Pataleta
parent 882734c99f
commit 7afca3b34a
3 changed files with 15 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/tool/uploaduser/user_form.php
+1 -1
View File
@@ -293,7 +293,7 @@ class admin_uploaduser_form2 extends moodleform {
$mform->setAdvanced('url');
$mform->addElement('text', 'idnumber', get_string('idnumber'), 'maxlength="255" size="25"');
$mform->setType('idnumber', PARAM_NOTAGS);
$mform->setType('idnumber', core_user::get_property_type('idnumber'));
$mform->setForceLtr('idnumber');
$mform->addElement('text', 'institution', get_string('institution'), 'maxlength="255" size="25"');
blocks/activity_results/block_activity_results.php
+13 -2
View File
@@ -512,6 +512,10 @@ class block_activity_results extends block_base {
$fields = implode(',', $fields);
$users = $DB->get_records_list('user', 'id', $userids, '', $fields);
// If configured to view user idnumber, ensure current user can see it.
$extrafields = get_extra_user_fields($this->context);
$canviewidnumber = (array_search('idnumber', $extrafields) !== false);
// Ready for output!
if ($activity->gradetype == GRADE_TYPE_SCALE) {
// We must display the results using scales.
@@ -537,10 +541,14 @@ class block_activity_results extends block_base {
}
$this->content->text .= '</h6></caption><colgroup class="number" />';
$this->content->text .= '<colgroup class="name" /><colgroup class="grade" /><tbody>';
foreach ($best as $userid => $gradeid) {
switch ($nameformat) {
case B_ACTIVITYRESULTS_NAME_FORMAT_ID:
$thisname = get_string('user').' '.$users[$userid]->idnumber;
$thisname = get_string('user');
if ($canviewidnumber) {
$thisname .= ' ' . s($users[$userid]->idnumber);
}
break;
case B_ACTIVITYRESULTS_NAME_FORMAT_ANON:
$thisname = get_string('user');
@@ -603,7 +611,10 @@ class block_activity_results extends block_base {
foreach ($worst as $userid => $gradeid) {
switch ($nameformat) {
case B_ACTIVITYRESULTS_NAME_FORMAT_ID:
$thisname = get_string('user').' '.$users[$userid]->idnumber;
$thisname = get_string('user');
if ($canviewidnumber) {
$thisname .= ' ' . s($users[$userid]->idnumber);
};
break;
case B_ACTIVITYRESULTS_NAME_FORMAT_ANON:
$thisname = get_string('user');
lib/myprofilelib.php
+1 -1
View File
@@ -209,7 +209,7 @@ function core_myprofile_navigation(core_user\output\myprofile\tree $tree, $user,
if (isset($identityfields['idnumber']) && $user->idnumber) {
$node = new core_user\output\myprofile\node('contact', 'idnumber', get_string('idnumber'), null, null,
$user->idnumber);
s($user->idnumber));
$tree->add_node($node);
}