From 13537c6d64946c3934176fb6f2831ed7ff46e0c3 Mon Sep 17 00:00:00 2001
From: Paul Holden <paulh@moodle.com>
Date: Thu, 3 Jun 2021 08:50:07 +0100
Subject: [PATCH] MDL-71846 group: consistent escaping of user/group names.

---
 group/clientlib.js             | 2 +-
 group/index.php                | 5 +++--
 group/templates/index.mustache | 2 +-
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/group/clientlib.js b/group/clientlib.js
index 8255c4442b1..9e433a196c4 100644
--- a/group/clientlib.js
+++ b/group/clientlib.js
@@ -97,7 +97,7 @@ function UpdatableMembersCombo(wwwRoot, courseId) {
                             var optionEl = document.createElement("option");
                             optionEl.setAttribute("value", roles[i].users[j].id);
                             optionEl.title = roles[i].users[j].name;
-                            optionEl.innerHTML = roles[i].users[j].name;
+                            optionEl.innerHTML = Y.Escape.html(roles[i].users[j].name);
                             optgroupEl.appendChild(optionEl);
                         }
                         selectEl.appendChild(optgroupEl);
diff --git a/group/index.php b/group/index.php
index c6b66525c0c..f2296fcf844 100644
--- a/group/index.php
+++ b/group/index.php
@@ -104,7 +104,8 @@ switch ($action) {
                     if ($extrafields) {
                         $extrafieldsdisplay = [];
                         foreach ($extrafields as $field) {
-                            $extrafieldsdisplay[] = s($member->{$field});
+                            // No escaping here, handled client side in response to AJAX request.
+                            $extrafieldsdisplay[] = $member->{$field};
                         }
                         $shortmember->name .= ' (' . implode(', ', $extrafieldsdisplay) . ')';
                     }
@@ -200,7 +201,7 @@ if ($groups) {
         $groupoptions[] = (object) [
             'value' => $group->id,
             'selected' => $selected,
-            'text' => $groupname
+            'text' => s($groupname)
         ];
     }
 }
diff --git a/group/templates/index.mustache b/group/templates/index.mustache
index 30e6d92f380..4a5b4d13220 100644
--- a/group/templates/index.mustache
+++ b/group/templates/index.mustache
@@ -120,7 +120,7 @@
                         {{#members}}
                             <optgroup label="{{role}}">
                                 {{#rolemembers}}
-                                    <option value="{{value}}">{{{text}}}‎</option>
+                                    <option value="{{value}}" title="{{{text}}}">{{{text}}}‎</option>
                                 {{/rolemembers}}
                             </optgroup>
                         {{/members}}