MDL-71846 group: consistent escaping of user/group names.

group/clientlib.js

@@ -97,7 +97,7 @@ function UpdatableMembersCombo(wwwRoot, courseId) {
                             var optionEl = document.createElement("option");
                             optionEl.setAttribute("value", roles[i].users[j].id);
                             optionEl.title = roles[i].users[j].name;
-                            optionEl.innerHTML = roles[i].users[j].name;
+                            optionEl.innerHTML = Y.Escape.html(roles[i].users[j].name);
                             optgroupEl.appendChild(optionEl);
                         }
                         selectEl.appendChild(optgroupEl);

group/index.php

@@ -98,7 +98,8 @@ switch ($action) {
                     if ($extrafields) {
                         $extrafieldsdisplay = [];
                         foreach ($extrafields as $field) {
-                            $extrafieldsdisplay[] = s($member->{$field});
+                            // No escaping here, handled client side in response to AJAX request.
+                            $extrafieldsdisplay[] = $member->{$field};
                         }
                         $shortmember->name .= ' (' . implode(', ', $extrafieldsdisplay) . ')';
                     }
@@ -194,7 +195,7 @@ if ($groups) {
         $groupoptions[] = (object) [
             'value' => $group->id,
             'selected' => $selected,
-            'text' => $groupname
+            'text' => s($groupname)
         ];
     }
 }

group/templates/index.mustache

@@ -120,7 +120,7 @@
                         {{#members}}
                             <optgroup label="{{role}}">
                                 {{#rolemembers}}
-                                    <option value="{{value}}">{{{text}}}‎</option>
+                                    <option value="{{value}}" title="{{{text}}}">{{{text}}}‎</option>
                                 {{/rolemembers}}
                             </optgroup>
                         {{/members}}