From b03c67e978b8763e1316ce8654aba67ec4e51ec5 Mon Sep 17 00:00:00 2001 From: Marina Glancy Date: Mon, 7 May 2018 11:18:09 +0800 Subject: [PATCH 1/2] MDL-61876 mod_data: call format_text on template before replacement Otherwise when $CFG->forceclean is enabled all search input fields are stripped out --- mod/data/lib.php | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/mod/data/lib.php b/mod/data/lib.php index c150d235b5f..0feba57674b 100644 --- a/mod/data/lib.php +++ b/mod/data/lib.php @@ -1918,13 +1918,12 @@ function data_print_preference_form($data, $perpage, $search, $sort='', $order=' } // actual replacement of the tags - $newtext = preg_replace($patterns, $replacement, $data->asearchtemplate); $options = new stdClass(); $options->para=false; $options->noclean=true; echo ''; - echo format_text($newtext, FORMAT_HTML, $options); + echo preg_replace($patterns, $replacement, format_text($data->asearchtemplate, FORMAT_HTML, $options)); echo ''; echo '
' . From 8852faea9138f5e2a483d6b9983e5847b1742383 Mon Sep 17 00:00:00 2001 From: Marina Glancy Date: Mon, 7 May 2018 11:20:32 +0800 Subject: [PATCH 2/2] MDL-61876 modules: cm_info::set_content can accept formatted text Allow modules to apply format_text() on user input before calling cm_info::set_content(). This is useful for modules that add interactive content (for example, JS enhanced folder tree). Otherwise all javascript would be removed if $CFG->forceclean is enabled. --- lib/modinfolib.php | 14 +++++++++++++- mod/folder/lib.php | 2 +- mod/folder/renderer.php | 5 +++-- mod/upgrade.txt | 7 +++++-- 4 files changed, 22 insertions(+), 6 deletions(-) diff --git a/lib/modinfolib.php b/lib/modinfolib.php index 98ef37e564c..8541eab51d1 100644 --- a/lib/modinfolib.php +++ b/lib/modinfolib.php @@ -1084,6 +1084,11 @@ class cm_info implements IteratorAggregate { */ private $content; + /** + * @var bool + */ + private $contentisformatted; + /** * @var string */ @@ -1338,6 +1343,10 @@ class cm_info implements IteratorAggregate { if (empty($this->content)) { return ''; } + if ($this->contentisformatted) { + return $this->content; + } + // Improve filter performance by preloading filter setttings for all // activities on the course (this does nothing if called multiple // times) @@ -1619,10 +1628,13 @@ class cm_info implements IteratorAggregate { /** * Sets content to display on course view page below link (if present). * @param string $content New content as HTML string (empty string if none) + * @param bool $isformatted Whether user content is already passed through format_text/format_string and should not + * be formatted again. This can be useful when module adds interactive elements on top of formatted user text. * @return void */ - public function set_content($content) { + public function set_content($content, $isformatted = false) { $this->content = $content; + $this->contentisformatted = $isformatted; } /** diff --git a/mod/folder/lib.php b/mod/folder/lib.php index 4c76c551565..d213cf491e9 100644 --- a/mod/folder/lib.php +++ b/mod/folder/lib.php @@ -470,7 +470,7 @@ function folder_cm_info_view(cm_info $cm) { } // display folder $renderer = $PAGE->get_renderer('mod_folder'); - $cm->set_content($renderer->display_folder($folder)); + $cm->set_content($renderer->display_folder($folder), true); } } diff --git a/mod/folder/renderer.php b/mod/folder/renderer.php index 421d96d90cf..ddcf62dd9a3 100644 --- a/mod/folder/renderer.php +++ b/mod/folder/renderer.php @@ -134,14 +134,15 @@ class mod_folder_renderer extends plugin_renderer_base { $filename = $file->get_filename(); $url = moodle_url::make_pluginfile_url($file->get_contextid(), $file->get_component(), $file->get_filearea(), $file->get_itemid(), $file->get_filepath(), $filename, false); + $filenamedisplay = clean_filename($filename); if (file_extension_in_typegroup($filename, 'web_image')) { $image = $url->out(false, array('preview' => 'tinyicon', 'oid' => $file->get_timemodified())); $image = html_writer::empty_tag('img', array('src' => $image)); } else { - $image = $this->output->pix_icon(file_file_icon($file, 24), $filename, 'moodle'); + $image = $this->output->pix_icon(file_file_icon($file, 24), $filenamedisplay, 'moodle'); } $filename = html_writer::tag('span', $image, array('class' => 'fp-icon')). - html_writer::tag('span', $filename, array('class' => 'fp-filename')); + html_writer::tag('span', $filenamedisplay, array('class' => 'fp-filename')); $filename = html_writer::tag('span', html_writer::link($url->out(false, array('forcedownload' => 1)), $filename), array('class' => 'fp-filename-icon')); diff --git a/mod/upgrade.txt b/mod/upgrade.txt index 495cdb303a7..00ffe0dfdc9 100644 --- a/mod/upgrade.txt +++ b/mod/upgrade.txt @@ -3,8 +3,11 @@ information provided here is intended especially for developers. === 3.5 === -Required changes in code: -* use new make_backup_temp_directory() +* Backup directory now can be outside of temp directory. Use make_backup_temp_directory($name) instead of + make_temp_directory('/backup/'.$name) +* Modules that provide their own interactive content and call cm_info::set_content() from [MODULENAME]_cm_info_view() + callback should format all user input and call set_content() with parameter $isformatted=true . Otherwise + scripts will be cleaned on the course page in case of $CFG->forceclean=1. See example in mod_folder. === 3.4 ===