MDL-11414 fixed handling of log urls (problem reported by Andreas Nolden)

diff --git a/course/lib.php b/course/lib.php
index 76f3a7a89bfe3a29de2d657f4a88df425b1e77d8..9ea5061781ba2c0838c090c592d9776e3bcd8990 100644 (file)
--- a/course/lib.php
+++ b/course/lib.php
@@ -514,7 +514,7 @@ function print_log($course, $user=0, $date=0, $order="l.time ASC", $page=0, $per
 
         $log->url  = strip_tags(urldecode($log->url));   // Some XSS protection
         $log->info = strip_tags(urldecode($log->info));  // Some XSS protection
-        $log->url  = str_replace('&', '&', $log->url); /// XHTML compatibility
+        $log->url  = s($log->url); /// XSS protection and XHTML compatibility - should be in link_to_popup_window() instead!!
 
         echo '<tr class="r'.$row.'">';
         if ($course->id == SITEID) {