From b779dc805ed58dc85710aa53e8fff1025a608c2c Mon Sep 17 00:00:00 2001 From: Tim Hunt Date: Mon, 2 Jul 2018 18:55:22 +0100 Subject: [PATCH] MDL-62820 question import: properly escape output --- mod/lesson/format.php | 4 ++-- question/format.php | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/mod/lesson/format.php b/mod/lesson/format.php index 02b58d66480..d7c68d695c1 100644 --- a/mod/lesson/format.php +++ b/mod/lesson/format.php @@ -726,8 +726,8 @@ class qformat_default { // @@PLUGINFILE@@ with a real URL, but it doesn't matter what. // We use http://example.com/. $text = str_replace('@@PLUGINFILE@@/', 'http://example.com/', $question->questiontext); - return html_to_text(format_text($text, - $question->questiontextformat, $formatoptions), 0, false); + return s(html_to_text(format_text($text, + $question->questiontextformat, $formatoptions), 0, false)); } /** diff --git a/question/format.php b/question/format.php index a2aeaa1c40d..ce8e91afb9d 100644 --- a/question/format.php +++ b/question/format.php @@ -938,8 +938,8 @@ class qformat_default { * during import to let the user see roughly what is going on. */ protected function format_question_text($question) { - return question_utils::to_plain_text($question->questiontext, - $question->questiontextformat); + return s(question_utils::to_plain_text($question->questiontext, + $question->questiontextformat)); } }