From f3b0e54bc9abc2a4f3fabcefd0a473c5a0f7731d Mon Sep 17 00:00:00 2001 From: Mihail Geshoski Date: Thu, 19 Dec 2024 12:20:14 +0800 Subject: [PATCH] MDL-82896 qtype_ddimageortext: Clean drop zone label text It is unnecessary to allow HTML to be added to the drop zone label text, as this content is hidden and only accessible to screen readers. Additionally, the content is currently not properly formatted, which introduces a risk for potential XSS exploits. This change ensures that only plain text (PARAM_TEXT) is allowed when adding content and that the content is properly formatted before being output. --- question/type/ddimageortext/edit_ddimageortext_form.php | 2 +- question/type/ddimageortext/rendererbase.php | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/question/type/ddimageortext/edit_ddimageortext_form.php b/question/type/ddimageortext/edit_ddimageortext_form.php index 21a2f46cb17..59b1d3b0b1d 100644 --- a/question/type/ddimageortext/edit_ddimageortext_form.php +++ b/question/type/ddimageortext/edit_ddimageortext_form.php @@ -197,7 +197,7 @@ class qtype_ddimageortext_edit_form extends qtype_ddtoimage_edit_form_base { // We do the necessary validation in the validation method. $repeatedoptions['drops[xleft]']['type'] = PARAM_RAW; $repeatedoptions['drops[ytop]']['type'] = PARAM_RAW; - $repeatedoptions['drops[droplabel]']['type'] = PARAM_RAW; + $repeatedoptions['drops[droplabel]']['type'] = PARAM_TEXT; $repeatedoptions['choice']['default'] = '0'; return $repeatedoptions; } diff --git a/question/type/ddimageortext/rendererbase.php b/question/type/ddimageortext/rendererbase.php index 640600090a4..e552cff7fb2 100644 --- a/question/type/ddimageortext/rendererbase.php +++ b/question/type/ddimageortext/rendererbase.php @@ -114,6 +114,7 @@ class qtype_ddtoimage_renderer_base extends qtype_with_combined_feedback_rendere $output .= $html; $placeinfo = (object) (array) $place; $placeinfo->fieldname = $fieldname; + $placeinfo->text = format_string($placeinfo->text); $placeinfoforjsandmobileapp[$placeno] = $placeinfo; }