From b327defe5d2bca62929accd59c0e10b449df73bd Mon Sep 17 00:00:00 2001
From: Jake Dallimore <jake@moodle.com>
Date: Thu, 12 May 2022 11:36:33 +0800
Subject: [PATCH] MDL-72299 mod_lti: fix html escaping when reposting cross
 site posts

---
 mod/lti/classes/output/repost_crosssite_page.php | 2 +-
 mod/lti/templates/repost_crosssite.mustache      | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/mod/lti/classes/output/repost_crosssite_page.php b/mod/lti/classes/output/repost_crosssite_page.php
index e7c3501b52e..23fc2cc679d 100644
--- a/mod/lti/classes/output/repost_crosssite_page.php
+++ b/mod/lti/classes/output/repost_crosssite_page.php
@@ -56,7 +56,7 @@ class repost_crosssite_page implements renderable, templatable {
      */
     public function __construct(string $url, array $post) {
         $this->params = array_map(function($k) use ($post) {
-            return ["key" => $k, "value" => str_replace("\"", "&quot;", $post[$k])];
+            return ["key" => $k, "value" => $post[$k]];
         }, array_keys($post));
         $this->url = $url;
     }
diff --git a/mod/lti/templates/repost_crosssite.mustache b/mod/lti/templates/repost_crosssite.mustache
index 84cacbc32b9..f44b4379024 100644
--- a/mod/lti/templates/repost_crosssite.mustache
+++ b/mod/lti/templates/repost_crosssite.mustache
@@ -37,9 +37,9 @@
     }
 
 }}
-<form action="{{{url}}}" method="POST" id="autopostme">
+<form action="{{url}}" method="POST" id="autopostme">
     {{#params}}
-    <input type="hidden" name="{{{key}}}" value="{{{value}}}">
+    <input type="hidden" name="{{key}}" value="{{value}}">
     {{/params}}
     <input type="hidden" name="repost" value="true">
 </form>