From f07e38fbcaf9b678f492699f1977c7eb6ff8fd7b Mon Sep 17 00:00:00 2001
From: skodak <skodak>
Date: Wed, 19 Nov 2008 16:47:36 +0000
Subject: [PATCH] MDL-17236 html block: proper cleanup of html; backported from
 HEAD

---
 blocks/html/block_html.php       | 11 ++++++++---
 blocks/html/config_instance.html | 11 +++++++++--
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/blocks/html/block_html.php b/blocks/html/block_html.php
index ff539610cbf..7099a43d1ff 100755
--- a/blocks/html/block_html.php
+++ b/blocks/html/block_html.php
@@ -12,7 +12,7 @@ class block_html extends block_base {
     }
 
     function specialization() {
-        $this->title = isset($this->config->title) ? $this->config->title : get_string('newhtmlblock', 'block_html');
+        $this->title = isset($this->config->title) ? format_string($this->config->title) : get_string('newhtmlblock', 'block_html');
     }
 
     function instance_allow_multiple() {
@@ -24,8 +24,13 @@ class block_html extends block_base {
             return $this->content;
         }
 
-        $filteropt = new stdClass;
-        $filteropt->noclean = true;
+        if (!empty($this->instance->pinned) or $this->instance->pagetype === 'course-view') {
+            // fancy html allowed only on course page and in pinned blocks for security reasons
+            $filteropt = new stdClass;
+            $filteropt->noclean = true;
+        } else {
+            $filteropt = null;
+        }
 
         $this->content = new stdClass;
         $this->content->text = isset($this->config->text) ? format_text($this->config->text, FORMAT_HTML, $filteropt) : '';
diff --git a/blocks/html/config_instance.html b/blocks/html/config_instance.html
index 8138488d026..ae2d46064ce 100755
--- a/blocks/html/config_instance.html
+++ b/blocks/html/config_instance.html
@@ -1,4 +1,11 @@
-<?php $usehtmleditor = can_use_html_editor(); ?>
+<?php
+    $usehtmleditor = can_use_html_editor();
+
+    $text = isset($this->config->text) ? $this->config->text : '';
+    if (empty($this->instance->pinned) and $this->instance->pagetype !== 'course-view') {
+        $text = clean_text($text, FORMAT_HTML);
+    }
+?>
 <table cellpadding="9" cellspacing="0">
 <tr valign="top">
     <td align="right"><?php print_string('configtitle', 'block_html'); ?>:</td>
@@ -6,7 +13,7 @@
 </tr>
 <tr valign="top">
     <td align="right"><?php print_string('configcontent', 'block_html'); ?>:</td>
-    <td><?php print_textarea($usehtmleditor, 25, 50, 0, 0, 'text', isset($this->config->text)?$this->config->text:'') ?></td>
+    <td><?php print_textarea($usehtmleditor, 25, 50, 0, 0, 'text', $text) ?></td>
 </tr>
 <tr>
     <td colspan="3" align="center">