From 875d4627ee6dfe2cd1af2fde7cc107d4c6d78bbd Mon Sep 17 00:00:00 2001
From: Mihail Geshoski <mihail@moodle.com>
Date: Thu, 19 Dec 2024 12:20:14 +0800
Subject: [PATCH] MDL-82896 qtype_ddimageortext: Clean drop zone label text

It is unnecessary to allow HTML to be added to the drop zone label text,
as this content is hidden and only accessible to screen readers.
Additionally, the content is currently not properly formatted, which
introduces a risk for potential XSS exploits. This change ensures that
only plain text (PARAM_TEXT) is allowed when adding content and that the
content is properly formatted before being output.
---
 question/type/ddimageortext/edit_ddimageortext_form.php | 2 +-
 question/type/ddimageortext/rendererbase.php            | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/question/type/ddimageortext/edit_ddimageortext_form.php b/question/type/ddimageortext/edit_ddimageortext_form.php
index 21a2f46cb17..59b1d3b0b1d 100644
--- a/question/type/ddimageortext/edit_ddimageortext_form.php
+++ b/question/type/ddimageortext/edit_ddimageortext_form.php
@@ -197,7 +197,7 @@ class qtype_ddimageortext_edit_form extends qtype_ddtoimage_edit_form_base {
         // We do the necessary validation in the validation method.
         $repeatedoptions['drops[xleft]']['type']     = PARAM_RAW;
         $repeatedoptions['drops[ytop]']['type']      = PARAM_RAW;
-        $repeatedoptions['drops[droplabel]']['type'] = PARAM_RAW;
+        $repeatedoptions['drops[droplabel]']['type'] = PARAM_TEXT;
         $repeatedoptions['choice']['default'] = '0';
         return $repeatedoptions;
     }
diff --git a/question/type/ddimageortext/rendererbase.php b/question/type/ddimageortext/rendererbase.php
index 3187b279318..b014dc61a55 100644
--- a/question/type/ddimageortext/rendererbase.php
+++ b/question/type/ddimageortext/rendererbase.php
@@ -109,6 +109,7 @@ class qtype_ddtoimage_renderer_base extends qtype_with_combined_feedback_rendere
                     ['placeinput', 'place' . $placeno, 'group' . $place->group]);
             $output .= $html;
             $question->places[$placeno]->fieldname = $fieldname;
+            $question->places[$placeno]->text = format_string($place->text);
         }
 
         $output .= html_writer::end_div();