MDL-82896 qtype_ddimageortext: Clean drop zone label text

It is unnecessary to allow HTML to be added to the drop zone label text,
as this content is hidden and only accessible to screen readers.
Additionally, the content is currently not properly formatted, which
introduces a risk for potential XSS exploits. This change ensures that
only plain text (PARAM_TEXT) is allowed when adding content and that the
content is properly formatted before being output.

question/type/ddimageortext/edit_ddimageortext_form.php

@@ -197,7 +197,7 @@ class qtype_ddimageortext_edit_form extends qtype_ddtoimage_edit_form_base {
         // We do the necessary validation in the validation method.
         $repeatedoptions['drops[xleft]']['type']     = PARAM_RAW;
         $repeatedoptions['drops[ytop]']['type']      = PARAM_RAW;
-        $repeatedoptions['drops[droplabel]']['type'] = PARAM_RAW;
+        $repeatedoptions['drops[droplabel]']['type'] = PARAM_TEXT;
         $repeatedoptions['choice']['default'] = '0';
         return $repeatedoptions;
     }

question/type/ddimageortext/rendererbase.php

@@ -109,6 +109,7 @@ class qtype_ddtoimage_renderer_base extends qtype_with_combined_feedback_rendere
                     ['placeinput', 'place' . $placeno, 'group' . $place->group]);
             $output .= $html;
             $question->places[$placeno]->fieldname = $fieldname;
+            $question->places[$placeno]->text = format_string($place->text);
         }
 
         $output .= html_writer::end_div();