Merge branch 'MDL-32114-400' of https://github.com/srobotta/moodle into MOODLE_400_STABLE

lib/weblib.php

@@ -1325,9 +1325,8 @@ function format_text($text, $format = FORMAT_MOODLE, $options = null, $courseidd
 
         case FORMAT_MARKDOWN:
             $text = markdown_to_html($text);
-            if (!$options['noclean']) {
-                $text = clean_text($text, FORMAT_HTML, $options);
-            }
+            // The markdown parser does not strip dangerous html so we need to clean it, even if noclean is set to true.
+            $text = clean_text($text, FORMAT_HTML, $options);
             $text = $filtermanager->filter_text($text, $context, $filteroptions);
             break;
 

mod/forum/post.php

@@ -343,7 +343,10 @@ if (!empty($forum)) {
         $canreplyprivately = forum_user_can_reply_privately($modcontext, $parent);
     }
 
-    $post = trusttext_pre_edit($post, 'message', $modcontext);
+    // If markdown is used, the parser does the job already, otherwise clean text from arbitrary code that might be dangerous.
+    if ($post->messageformat != FORMAT_MARKDOWN) {
+        $post = trusttext_pre_edit($post, 'message', $modcontext);
+    }
 
     // Unsetting this will allow the correct return URL to be calculated later.
     unset($SESSION->fromdiscussion);
@@ -796,9 +799,10 @@ if ($mformpost->is_cancelled()) {
     // WARNING: the $fromform->message array has been overwritten, do not use it anymore!
     $fromform->messagetrust  = trusttext_trusted($modcontext);
 
-    // Clean message text.
-    $fromform = trusttext_pre_edit($fromform, 'message', $modcontext);
-
+    // Clean message text, unless markdown which should be saved as it is, otherwise editing messes things up.
+    if ($fromform->messageformat != FORMAT_MARKDOWN) {
+        $fromform = trusttext_pre_edit($fromform, 'message', $modcontext);
+    }
     if ($fromform->edit) {
         // Updating a post.
         unset($fromform->groupid);

theme/boost/scss/moodle/core.scss

@@ -2977,3 +2977,10 @@ body.dragging {
         }
     }
 }
+
+blockquote {
+    margin: 0 0.5rem 1rem;
+    padding-left: 1rem;
+    color: $gray-700;
+    border-left: 5px solid $gray-400;
+}

theme/boost/style/moodle.css

@@ -12290,6 +12290,12 @@ body.dragging .dragging {
   border-top-right-radius: 0.2rem;
   border-bottom-right-radius: 0.2rem; }
 
+blockquote {
+  margin: 0 0.5rem 1rem;
+  padding-left: 1rem;
+  color: #495057;
+  border-left: 5px solid #ced4da; }
+
 .icon {
   font-size: 16px;
   width: 16px;

theme/classic/style/moodle.css

@@ -12290,6 +12290,12 @@ body.dragging .dragging {
   border-top-right-radius: 0.2rem;
   border-bottom-right-radius: 0.2rem; }
 
+blockquote {
+  margin: 0 0.5rem 1rem;
+  padding-left: 1rem;
+  color: #495057;
+  border-left: 5px solid #ced4da; }
+
 .icon {
   font-size: 16px;
   width: 16px;