From 8d65efee7cd17c01d8f933fe2b0a0cd90d900104 Mon Sep 17 00:00:00 2001 From: Juan Leyva Date: Mon, 2 Oct 2023 13:10:52 +0200 Subject: [PATCH] MDL-79557 message: Clean subject field content for get_messages WS --- message/externallib.php | 2 ++ message/tests/externallib_test.php | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/message/externallib.php b/message/externallib.php index 6ab06d1a389..6e675bb4411 100644 --- a/message/externallib.php +++ b/message/externallib.php @@ -2134,6 +2134,8 @@ class core_message_external extends external_api { $message->usertofullname = $usertofullname; } + // Clean subject of html. + $message->subject = clean_param($message->subject, PARAM_TEXT); $message->text = message_format_message_text($message); $messages[$mid] = (array) $message; } diff --git a/message/tests/externallib_test.php b/message/tests/externallib_test.php index 530c655676a..af484223ec2 100644 --- a/message/tests/externallib_test.php +++ b/message/tests/externallib_test.php @@ -1437,13 +1437,14 @@ class externallib_test extends externallib_advanced_testcase { $eventdata->smallmessage = $eventdata->subject; message_send($eventdata); + // This event contains HTML in the subject field that will be removed by the WS (otherwise it will generate an exception). $eventdata = new \core\message\message(); $eventdata->courseid = $course->id; $eventdata->name = 'submission'; $eventdata->component = 'mod_feedback'; $eventdata->userfrom = $user1; $eventdata->userto = $user2; - $eventdata->subject = 'Feedback submitted'; + $eventdata->subject = 'Feedback submitted with html'; $eventdata->fullmessage = 'Feedback submitted from an user'; $eventdata->fullmessageformat = FORMAT_PLAIN; $eventdata->fullmessagehtml = 'Feedback submitted';