From a7085963b5db0ce84389bab7d764a870829a1490 Mon Sep 17 00:00:00 2001
From: Cameron Ball <cameron@moodle.com>
Date: Mon, 29 Aug 2016 18:28:10 +0800
Subject: [PATCH] MDL-55587 core_media: Properly escape ampersand

---
 filter/mediaplugin/tests/filter_test.php | 2 +-
 lib/medialib.php                         | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/filter/mediaplugin/tests/filter_test.php b/filter/mediaplugin/tests/filter_test.php
index 0d3175f34e6..13173eee4b2 100644
--- a/filter/mediaplugin/tests/filter_test.php
+++ b/filter/mediaplugin/tests/filter_test.php
@@ -105,7 +105,7 @@ class filter_mediaplugin_testcase extends advanced_testcase {
         $paddedurl = str_pad($originalurl, 6000, 'z');
         $validpaddedurl = '<p>Some text.</p><pre style="color: rgb(0, 0, 0); line-height: normal;"><span class="mediaplugin mediaplugin_youtube">
 <iframe title="Valid link" width="400" height="300"
-  src="https://www.youtube.com/embed/uUhWl9Lm3OM?rel=0&wmode=transparent" frameborder="0" allowfullscreen="1"></iframe>
+  src="https://www.youtube.com/embed/uUhWl9Lm3OM?rel=0&amp;wmode=transparent" frameborder="0" allowfullscreen="1"></iframe>
 </span></pre><pre style="color: rgb(0, 0, 0); line-height: normal;">';
         $validpaddedurl = str_pad($validpaddedurl, 6000 + (strlen($validpaddedurl) - strlen($originalurl)), 'z');
 
diff --git a/lib/medialib.php b/lib/medialib.php
index 23d4379bdb4..f19bcbefbcf 100644
--- a/lib/medialib.php
+++ b/lib/medialib.php
@@ -540,20 +540,20 @@ class core_media_player_youtube extends core_media_player_external {
         $params = '';
         $start = self::get_start_time($url);
         if ($start > 0) {
-            $params .= "start=$start&";
+            $params .= "start=$start&amp;";
         }
 
         $listid = $url->param('list');
         // Check for non-empty but valid playlist ID.
         if (!empty($listid) && !preg_match('/[^a-zA-Z0-9\-_]/', $listid)) {
             // This video is part of a playlist, and we want to embed it as such.
-            $params .= "list=$listid&";
+            $params .= "list=$listid&amp;";
         }
 
         return <<<OET
 <span class="mediaplugin mediaplugin_youtube">
 <iframe title="$info" width="$width" height="$height"
-  src="https://www.youtube.com/embed/$videoid?{$params}rel=0&wmode=transparent" frameborder="0" allowfullscreen="1"></iframe>
+  src="https://www.youtube.com/embed/$videoid?{$params}rel=0&amp;wmode=transparent" frameborder="0" allowfullscreen="1"></iframe>
 </span>
 OET;