From fac52f6f863825017ef587be7eb0360acf80ae22 Mon Sep 17 00:00:00 2001 From: Mihail Geshoski Date: Thu, 19 Dec 2024 12:20:14 +0800 Subject: [PATCH] MDL-82896 qtype_ddimageortext: Clean drop zone label text It is unnecessary to allow HTML to be added to the drop zone label text, as this content is hidden and only accessible to screen readers. Additionally, the content is currently not properly formatted, which introduces a risk for potential XSS exploits. This change ensures that only plain text (PARAM_TEXT) is allowed when adding content and that the content is properly formatted before being output. --- question/type/ddimageortext/edit_ddimageortext_form.php | 2 +- question/type/ddimageortext/rendererbase.php | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/question/type/ddimageortext/edit_ddimageortext_form.php b/question/type/ddimageortext/edit_ddimageortext_form.php index 21a2f46cb17..59b1d3b0b1d 100644 --- a/question/type/ddimageortext/edit_ddimageortext_form.php +++ b/question/type/ddimageortext/edit_ddimageortext_form.php @@ -197,7 +197,7 @@ class qtype_ddimageortext_edit_form extends qtype_ddtoimage_edit_form_base { // We do the necessary validation in the validation method. $repeatedoptions['drops[xleft]']['type'] = PARAM_RAW; $repeatedoptions['drops[ytop]']['type'] = PARAM_RAW; - $repeatedoptions['drops[droplabel]']['type'] = PARAM_RAW; + $repeatedoptions['drops[droplabel]']['type'] = PARAM_TEXT; $repeatedoptions['choice']['default'] = '0'; return $repeatedoptions; } diff --git a/question/type/ddimageortext/rendererbase.php b/question/type/ddimageortext/rendererbase.php index cb201cd397d..294a60afe23 100644 --- a/question/type/ddimageortext/rendererbase.php +++ b/question/type/ddimageortext/rendererbase.php @@ -114,6 +114,7 @@ class qtype_ddtoimage_renderer_base extends qtype_with_combined_feedback_rendere $output .= $html; $placeinfo = (object) (array) $place; $placeinfo->fieldname = $fieldname; + $placeinfo->text = format_string($placeinfo->text); $placeinfoforjsandmobileapp[$placeno] = $placeinfo; }