From 8fdda09338ba35e250bf96e566ac342996d5ff88 Mon Sep 17 00:00:00 2001
From: Stevani Andolo <stevani.andolo@moodle.com>
Date: Thu, 11 Apr 2024 14:39:24 +0800
Subject: [PATCH] MDL-81354 core: Escape string of fullname

---
 group/classes/output/user_groups_editable.php | 1 +
 user/classes/output/user_roles_editable.php   | 6 ++++--
 user/classes/table/participants.php           | 2 +-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/group/classes/output/user_groups_editable.php b/group/classes/output/user_groups_editable.php
index 13dba2adad9..e90da23d867 100644
--- a/group/classes/output/user_groups_editable.php
+++ b/group/classes/output/user_groups_editable.php
@@ -79,6 +79,7 @@ class user_groups_editable extends \core\output\inplace_editable {
         }
 
         $fullname = fullname($user, has_capability('moodle/site:viewfullnames', $this->context));
+        $fullname = htmlspecialchars($fullname, ENT_QUOTES, 'utf-8');
         $this->edithint = get_string('editusersgroupsa', 'group', $fullname);
         $this->editlabel = get_string('editusersgroupsa', 'group', $fullname);
 
diff --git a/user/classes/output/user_roles_editable.php b/user/classes/output/user_roles_editable.php
index d5562f18a1c..d959d0b3327 100644
--- a/user/classes/output/user_roles_editable.php
+++ b/user/classes/output/user_roles_editable.php
@@ -92,8 +92,10 @@ class user_roles_editable extends \core\output\inplace_editable {
                 }
             }
         }
-        $this->edithint = get_string('xroleassignments', 'role', fullname($user));
-        $this->editlabel = get_string('xroleassignments', 'role', fullname($user));
+
+        $fullname = htmlspecialchars(fullname($user), ENT_QUOTES, 'utf-8');
+        $this->edithint = get_string('xroleassignments', 'role', $fullname);
+        $this->editlabel = get_string('xroleassignments', 'role', $fullname);
 
         $attributes = ['multiple' => true];
         $this->set_type_autocomplete($options, $attributes);
diff --git a/user/classes/table/participants.php b/user/classes/table/participants.php
index a83490f8798..d8264c70212 100644
--- a/user/classes/table/participants.php
+++ b/user/classes/table/participants.php
@@ -335,7 +335,7 @@ class participants extends \table_sql implements dynamic_table {
         $canreviewenrol = has_capability('moodle/course:enrolreview', $this->context);
         if ($canreviewenrol) {
             $canviewfullnames = has_capability('moodle/site:viewfullnames', $this->context);
-            $fullname = fullname($data, $canviewfullnames);
+            $fullname = htmlspecialchars(fullname($data, $canviewfullnames), ENT_QUOTES, 'utf-8');
             $coursename = format_string($this->course->fullname, true, array('context' => $this->context));
             require_once($CFG->dirroot . '/enrol/locallib.php');
             $manager = new \course_enrolment_manager($PAGE, $this->course);