From 7bb6b84cfd308bad89dc0c3f95ad2fa55b7d25f8 Mon Sep 17 00:00:00 2001
From: Andreas Grabs <moodle@grabs-edv.de>
Date: Sun, 26 Oct 2014 20:37:52 +0100
Subject: [PATCH] MDL-47865 mod_feedback - XSS through $searchstring in
 mod/feedback/mapcourse.php

---
 mod/feedback/mapcourse.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/mod/feedback/mapcourse.php b/mod/feedback/mapcourse.php
index 6545ef434c4..90606d51c74 100644
--- a/mod/feedback/mapcourse.php
+++ b/mod/feedback/mapcourse.php
@@ -111,11 +111,11 @@ if (($courses = $DB->get_records_sql_menu($sql, $params)) && !empty($searchcours
                 'value="'.get_string('searchagain').'" '.
                 'onclick="document.location=\'mapcourse.php?id='.$id.'\'"/>';
 
-    echo '<input type="hidden" name="searchcourse" value="'.$searchcourse.'"/>';
+    echo '<input type="hidden" name="searchcourse" value="'.s($searchcourse).'"/>';
     echo '<input type="hidden" name="feedbackid" value="'.$feedback->id.'"/>';
     echo $OUTPUT->help_icon('searchcourses', 'feedback');
 } else {
-    echo '<input type="text" name="searchcourse" value="'.$searchcourse.'"/> ';
+    echo '<input type="text" name="searchcourse" value="'.s($searchcourse).'"/> ';
     echo '<input type="submit" value="'.get_string('searchcourses').'"/>';
     echo $OUTPUT->help_icon('searchcourses', 'feedback');
 }