MDL-66762 user: escape extra/email user fields.

2019-11-07 09:02:35 +08:00
parent 8d111d5136
commit a722b44a09
11 changed files with 14 additions and 17 deletions
@@ -401,7 +401,7 @@
            $row = array ();
            $row[] = "<a href=\"../user/view.php?id=$user->id&amp;course=$site->id\">$fullname</a>";
            foreach ($extracolumns as $field) {
-                $row[] = $user->{$field};
+                $row[] = s($user->{$field});
            }
            $row[] = $user->city;
            $row[] = $user->country;