From 74a2ee73ed8a5d7637f5b1f5408d6dc2cde6bf5c Mon Sep 17 00:00:00 2001
From: Matteo Scaramuccia <moodle@matteoscaramuccia.com>
Date: Mon, 21 Mar 2011 21:13:52 +0100
Subject: [PATCH 1/2] SCORM MDL-18392 MDL-26282 - Fixed calls to add/strip
 slashes

---
 mod/scorm/locallib.php | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/mod/scorm/locallib.php b/mod/scorm/locallib.php
index 56f3d3567a7..e57217a88b6 100644
--- a/mod/scorm/locallib.php
+++ b/mod/scorm/locallib.php
@@ -387,7 +387,7 @@ function scorm_insert_track($userid,$scormid,$scoid,$attempt,$element,$value,$fo
 
     if ($track = $DB->get_record('scorm_scoes_track',array('userid'=>$userid, 'scormid'=>$scormid, 'scoid'=>$scoid, 'attempt'=>$attempt, 'element'=>$element))) {
         if ($element != 'x.start.time' ) { //don't update x.start.time - keep the original value.
-            $track->value = addslashes_js($value);
+            $track->value = $value;
             $track->timemodified = time();
             $DB->update_record('scorm_scoes_track',$track);
             $id = $track->id;
@@ -398,7 +398,7 @@ function scorm_insert_track($userid,$scormid,$scoid,$attempt,$element,$value,$fo
         $track->scoid = $scoid;
         $track->attempt = $attempt;
         $track->element = $element;
-        $track->value = addslashes_js($value);
+        $track->value = $value;
         $track->timemodified = time();
         $id = $DB->insert_record('scorm_scoes_track',$track);
     }
@@ -436,7 +436,6 @@ function scorm_get_tracks($scoid,$userid,$attempt='') {
         $usertrack->timemodified = 0;
         foreach ($tracks as $track) {
             $element = $track->element;
-            $track->value = stripslashes($track->value); // TODO: this is probably wrong, the stripslashes() has undefined meaning now; was this related to JS quoting or magic quotes?
             $usertrack->{$element} = $track->value;
             switch ($element) {
                 case 'cmi.core.lesson_status':

From 26daa23d9db4786cc1d56437a012c571f0aab546 Mon Sep 17 00:00:00 2001
From: Dan Marsden <dan@catalyst.net.nz>
Date: Wed, 13 Apr 2011 20:00:59 +1200
Subject: [PATCH 2/2] SCORM MDL-18392 - remove old call to stripslashes

---
 mod/scorm/aicc.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mod/scorm/aicc.php b/mod/scorm/aicc.php
index ed08cf40094..07c6e7fdacc 100644
--- a/mod/scorm/aicc.php
+++ b/mod/scorm/aicc.php
@@ -267,7 +267,7 @@
                                             $value .= $datarow."\r\n";
                                             next($datarows);
                                         }
-                                        $value = rawurlencode(stripslashes($value)); // TODO: this is probably wrong, the stripslashes() has undefined meaning now; was this related to JS quoting or magic quotes?
+                                        $value = rawurlencode($value);
                                         $id = scorm_insert_track($USER->id, $scorm->id, $sco->id, $attempt, $element, $value);
                                     }
                                 }