diff --git a/question/bank/managecategories/classes/output/category.php b/question/bank/managecategories/classes/output/category.php index e259b2cef4c..ee885be5a15 100644 --- a/question/bank/managecategories/classes/output/category.php +++ b/question/bank/managecategories/classes/output/category.php @@ -90,7 +90,7 @@ class category implements renderable, templatable { // Each section adds html to be displayed as part of this list item. $questionbankurl = new moodle_url('/question/edit.php', $params); $questionbankurl->param('cat', helper::combine_id_context($this->category)); - $categoryname = format_string($this->category->name, true, ['context' => $this->context]); + $categoryname = format_string($this->category->name, true, ['context' => $this->context, 'escape' => false]); $idnumber = null; if ($this->category->idnumber !== null && $this->category->idnumber !== '') { $idnumber = $this->category->idnumber; diff --git a/question/bank/managecategories/templates/category.mustache b/question/bank/managecategories/templates/category.mustache index 68b2db3a11d..5ccbbdbaa8c 100644 --- a/question/bank/managecategories/templates/category.mustache +++ b/question/bank/managecategories/templates/category.mustache @@ -22,10 +22,10 @@ Context variables required for this template: * categoryid - The id of the category this item represents. * questionbankurl - Url for corresponding question bank. - * categoryname - Category name. + * categoryname - Category name. Raw string. Will be HTML-escaped during rendering. * idnumber - Id number string (optional). * questioncount - Number of question in question bank. - * categorydesc - Category description. + * categorydesc - Category description. HTML that is safe to output (e.g. from format_text). * editactionmenu - Edit action menu link. * draghandle - Boolean if handle should be displayed (if category is movable). * children - Children category item to curent category (same variables as those above). @@ -34,7 +34,7 @@ { "categoryid": "1", "questionbankurl": "question/edit.php?cmid=123", - "categoryname": "Default for Miscellaneous", + "categoryname": "Default for Miscellaneous & < > \" '", "idnumber": "1", "questioncount": " 1", "categorydesc": "The default category for questions shared in context Miscellaneous", diff --git a/question/bank/managecategories/templates/category_details.mustache b/question/bank/managecategories/templates/category_details.mustache index 78ffee3b7b3..375f50f4d55 100644 --- a/question/bank/managecategories/templates/category_details.mustache +++ b/question/bank/managecategories/templates/category_details.mustache @@ -22,10 +22,10 @@ Context variables required for this template: * categoryid - The id of the category this item represents. * questionbankurl - Url for corresponding question bank. - * categoryname - Category name. + * categoryname - Category name. Raw string. Will be HTML-escaped during rendering. * idnumber - Id number string (optional). * questioncount - Number of question in question bank. - * categorydesc - Category description. + * categorydesc - Category description. HTML that is safe to output (e.g. from format_text). * editactionmenu - Edit action menu link. * draghandle - Boolean if handle should be displayed (if category is movable). * children - Children category item to curent category (same variables as those above). @@ -34,7 +34,7 @@ { "categoryid": "1", "questionbankurl": "question/edit.php?cmid=123", - "categoryname": "Default for Miscellaneous", + "categoryname": "Default for Miscellaneous & < > \" '", "idnumber": "1", "questioncount": " 1", "categorydesc": "The default category for questions shared in context Miscellaneous", @@ -44,7 +44,7 @@ }} - {{{categoryname}}} + {{categoryname}} {{#idnumber}} diff --git a/question/bank/managecategories/tests/behat/question_categories.feature b/question/bank/managecategories/tests/behat/question_categories.feature index e75e5077617..e9443cc31de 100644 --- a/question/bank/managecategories/tests/behat/question_categories.feature +++ b/question/bank/managecategories/tests/behat/question_categories.feature @@ -18,13 +18,13 @@ Feature: A teacher can put questions in categories in the question bank | activity | name | course | idnumber | | qbank | Qbank 1 | C1 | qbank1 | And the following "question categories" exist: - | contextlevel | reference | questioncategory | name | - | Activity module | qbank1 | Top | top | - | Activity module | qbank1 | top | Default for qbank1 | - | Activity module | qbank1 | Default for qbank1 | Subcategory | - | Activity module | qbank1 | Default for qbank1 | Another subcat | - | Activity module | qbank1 | top | Used category | - | Activity module | qbank1 | top | Default & testing | + | contextlevel | reference | questioncategory | name | + | Activity module | qbank1 | Top | top | + | Activity module | qbank1 | top | Default for qbank1 | + | Activity module | qbank1 | Default for qbank1 | Subcategory & < > " ' & | + | Activity module | qbank1 | Default for qbank1 | Another subcat | + | Activity module | qbank1 | top | Used category | + | Activity module | qbank1 | top | Default & testing | And the following "questions" exist: | questioncategory | qtype | name | questiontext | | Used category | essay | Test question to be moved | Write about whatever you want | @@ -53,9 +53,9 @@ Feature: A teacher can put questions in categories in the question bank When I am on the "Qbank 1" "core_question > question categories" page # There have been bugs which only happened if a question category was not empty, so add a question. And the following "questions" exist: - | questioncategory | qtype | name | questiontext | - | Subcategory | essay | Test question for renaming category | Write about whatever you want | - And I open the action menu in "Subcategory" "list_item" + | questioncategory | qtype | name | questiontext | + | Subcategory & < > " ' & | essay | Test question for renaming category | Write about whatever you want | + And I open the action menu in "Subcategory & < > \" ' &" "list_item" And I choose "Edit settings" in the open action menu And the field "parent" matches value "   Default for qbank1" And I set the following fields to these values: @@ -68,10 +68,12 @@ Feature: A teacher can put questions in categories in the question bank Scenario: An empty question category can be deleted When I am on the "Qbank 1" "core_question > question categories" page + And I should see "Subcategory & < > \" ' &" + And the "title" attribute of "span.qbank_managecategories-newchild.dropready" "css_element" should contain "As new child of Subcategory & < > \" ' &" And I open the action menu in "Subcategory" "list_item" And I choose "Delete" in the open action menu And I click on "Delete" "button" in the "Delete" "dialogue" - Then I should not see "Subcategory" + Then I should not see "Subcategory & < > \" ' &" Scenario: An non-empty question category can be deleted if you move the contents elsewhere When I am on the "Qbank 1" "core_question > question categories" page