From b1f400ae6f0138ac6f03a352aea0f06f18622821 Mon Sep 17 00:00:00 2001
From: "Andrew Davis (andyjdavis)" <andrew@moodle.com>
Date: Fri, 19 Aug 2011 16:53:32 +0800
Subject: [PATCH] MDL-27823 messaging: preventing html tags from being output
 to the UI

---
 lib/moodlelib.php      | 19 ++++++++++++++-----
 message/lib.php        | 10 ++++++++--
 user/messageselect.php | 14 ++++++++------
 3 files changed, 30 insertions(+), 13 deletions(-)

diff --git a/lib/moodlelib.php b/lib/moodlelib.php
index bc8955c4030..0a60b3f0540 100644
--- a/lib/moodlelib.php
+++ b/lib/moodlelib.php
@@ -9153,11 +9153,13 @@ function message_popup_window() {
     }
 
     //got unread messages so now do another query that joins with the user table
-    $messagesql = "SELECT m.id, m.smallmessage, m.notification, u.firstname, u.lastname FROM {message} m
-JOIN {message_working} mw ON m.id=mw.unreadmessageid
-JOIN {message_processors} p ON mw.processorid=p.id
-JOIN {user} u ON m.useridfrom=u.id
-WHERE m.useridto = :userid AND p.name='popup'";
+    $messagesql = "SELECT m.id, m.smallmessage, m.fullmessageformat, m.notification, u.firstname, u.lastname
+                     FROM {message} m
+                     JOIN {message_working} mw ON m.id=mw.unreadmessageid
+                     JOIN {message_processors} p ON mw.processorid=p.id
+                     JOIN {user} u ON m.useridfrom=u.id
+                    WHERE m.useridto = :userid
+                      AND p.name='popup'";
 
     //if the user was last notified over an hour ago we can renotify them of old messages
     //so don't worry about when the new message was sent
@@ -9192,6 +9194,13 @@ WHERE m.useridto = :userid AND p.name='popup'";
                 } else {
                     $smallmessage = $message_users->smallmessage;
                 }
+
+                //prevent html symbols being displayed
+                if ($message_users->fullmessageformat == FORMAT_HTML) {
+                    $smallmessage = html_to_text($smallmessage);
+                } else {
+                    $smallmessage = s($smallmessage);
+                }
             } else if ($message_users->notification) {
                 //its a notification with no smallmessage so just say they have a notification
                 $smallmessage = get_string('unreadnewnotification', 'message');
diff --git a/message/lib.php b/message/lib.php
index 197e5bc6b3f..72685cc109f 100644
--- a/message/lib.php
+++ b/message/lib.php
@@ -1880,9 +1880,15 @@ function message_format_message($message, $format='', $keywords='', $class='othe
 
     //if supplied display small messages as fullmessage may contain boilerplate text that shouldnt appear in the messaging UI
     if (!empty($message->smallmessage)) {
-        $messagetext = format_text(s($message->smallmessage), FORMAT_MOODLE, $options);
+        $messagetext = $message->smallmessage;
     } else {
-        $messagetext = format_text(s($message->fullmessage), $message->fullmessageformat, $options);
+        $messagetext = $message->fullmessage;
+    }
+    if ($message->fullmessageformat == FORMAT_HTML) {
+        //dont escape html tags by calling s() if html format or they will display in the UI
+        $messagetext = html_to_text(format_text($messagetext, $message->fullmessageformat, $options));
+    } else {
+        $messagetext = format_text(s($messagetext), $message->fullmessageformat, $options);
     }
 
     $messagetext .= message_format_contexturl($message);
diff --git a/user/messageselect.php b/user/messageselect.php
index d60fec19919..a210d30a941 100644
--- a/user/messageselect.php
+++ b/user/messageselect.php
@@ -91,12 +91,14 @@ $messagebody = $SESSION->emailselect[$id]['messagebody'];
 
 $count = 0;
 
-foreach ($_POST as $k => $v) {
-    if (preg_match('/^(user|teacher)(\d+)$/',$k,$m)) {
-        if (!array_key_exists($m[2],$SESSION->emailto[$id])) {
-            if ($user = $DB->get_record_select('user', "id = ?", array($m[2]), 'id,firstname,lastname,idnumber,email,mailformat,lastaccess, lang')) {
-                $SESSION->emailto[$id][$m[2]] = $user;
-                $count++;
+if ($data = data_submitted()) {
+    foreach ($data as $k => $v) {
+        if (preg_match('/^(user|teacher)(\d+)$/',$k,$m)) {
+            if (!array_key_exists($m[2],$SESSION->emailto[$id])) {
+                if ($user = $DB->get_record_select('user', "id = ?", array($m[2]), 'id,firstname,lastname,idnumber,email,mailformat,lastaccess, lang')) {
+                    $SESSION->emailto[$id][$m[2]] = $user;
+                    $count++;
+                }
             }
         }
     }