From 8ac7c623d385fd41a2d1d0c00e4eb36752ea76f2 Mon Sep 17 00:00:00 2001 From: Tim Hunt Date: Mon, 2 Jul 2018 18:55:22 +0100 Subject: [PATCH] MDL-62820 question import: properly escape output --- mod/lesson/format.php | 4 ++-- question/format.php | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/mod/lesson/format.php b/mod/lesson/format.php index 02b58d66480..d7c68d695c1 100644 --- a/mod/lesson/format.php +++ b/mod/lesson/format.php @@ -726,8 +726,8 @@ class qformat_default { // @@PLUGINFILE@@ with a real URL, but it doesn't matter what. // We use http://example.com/. $text = str_replace('@@PLUGINFILE@@/', 'http://example.com/', $question->questiontext); - return html_to_text(format_text($text, - $question->questiontextformat, $formatoptions), 0, false); + return s(html_to_text(format_text($text, + $question->questiontextformat, $formatoptions), 0, false)); } /** diff --git a/question/format.php b/question/format.php index 2efb253ad5b..9677c19f083 100644 --- a/question/format.php +++ b/question/format.php @@ -979,8 +979,8 @@ class qformat_default { * during import to let the user see roughly what is going on. */ protected function format_question_text($question) { - return question_utils::to_plain_text($question->questiontext, - $question->questiontextformat); + return s(question_utils::to_plain_text($question->questiontext, + $question->questiontextformat)); } }