L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-47865 mod_feedback - XSS through $searchstring in mod/feedback/mapcourse.php

Browse Source
This commit is contained in:
Andreas Grabs
2014-11-03 14:56:56 +08:00
committed by Marina Glancy
parent 293e4bbcb7
commit 7bb6b84cfd
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod/feedback/mapcourse.php
+2 -2
View File
@@ -111,11 +111,11 @@ if (($courses = $DB->get_records_sql_menu($sql, $params)) && !empty($searchcours
'value="'.get_string('searchagain').'" '.
'onclick="document.location=\'mapcourse.php?id='.$id.'\'"/>';
echo '<input type="hidden" name="searchcourse" value="'.$searchcourse.'"/>';
echo '<input type="hidden" name="searchcourse" value="'.s($searchcourse).'"/>';
echo '<input type="hidden" name="feedbackid" value="'.$feedback->id.'"/>';
echo $OUTPUT->help_icon('searchcourses', 'feedback');
} else {
echo '<input type="text" name="searchcourse" value="'.$searchcourse.'"/> ';
echo '<input type="text" name="searchcourse" value="'.s($searchcourse).'"/> ';
echo '<input type="submit" value="'.get_string('searchcourses').'"/>';
echo $OUTPUT->help_icon('searchcourses', 'feedback');
}