L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-81354 core: Escape string of fullname

Browse Source
This commit is contained in:
Stevani Andolo
2024-04-17 03:24:19 +00:00
committed by Jenkins
parent 593204b45d
commit 8fdda09338
3 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
group/classes/output/user_groups_editable.php
+1
View File
@@ -79,6 +79,7 @@ class user_groups_editable extends \core\output\inplace_editable {
}
$fullname = fullname($user, has_capability('moodle/site:viewfullnames', $this->context));
$fullname = htmlspecialchars($fullname, ENT_QUOTES, 'utf-8');
$this->edithint = get_string('editusersgroupsa', 'group', $fullname);
$this->editlabel = get_string('editusersgroupsa', 'group', $fullname);
user/classes/output/user_roles_editable.php
+4 -2
View File
@@ -92,8 +92,10 @@ class user_roles_editable extends \core\output\inplace_editable {
}
}
}
$this->edithint = get_string('xroleassignments', 'role', fullname($user));
$this->editlabel = get_string('xroleassignments', 'role', fullname($user));
$fullname = htmlspecialchars(fullname($user), ENT_QUOTES, 'utf-8');
$this->edithint = get_string('xroleassignments', 'role', $fullname);
$this->editlabel = get_string('xroleassignments', 'role', $fullname);
$attributes = ['multiple' => true];
$this->set_type_autocomplete($options, $attributes);
user/classes/table/participants.php
+1 -1
View File
@@ -335,7 +335,7 @@ class participants extends \table_sql implements dynamic_table {
$canreviewenrol = has_capability('moodle/course:enrolreview', $this->context);
if ($canreviewenrol) {
$canviewfullnames = has_capability('moodle/site:viewfullnames', $this->context);
$fullname = fullname($data, $canviewfullnames);
$fullname = htmlspecialchars(fullname($data, $canviewfullnames), ENT_QUOTES, 'utf-8');
$coursename = format_string($this->course->fullname, true, array('context' => $this->context));
require_once($CFG->dirroot . '/enrol/locallib.php');
$manager = new \course_enrolment_manager($PAGE, $this->course);