MDL-7493 further fix: strip_tags from title strings because the titles may have HTML...

  -From Martin D/moodler in moodleblock.class.php - thanks.

diff --git a/lib/weblib.php b/lib/weblib.php
index 374c2d09fa6b2d4c46f2ba22690ceac2570eec00..99b034a807e786fb848a770c7a82dbdc03318321 100644 (file)
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -6508,8 +6508,8 @@ function print_side_block_end($attributes = array(), $title='') {
 
     echo '</div>';
 
-    $strshow = addslashes_js(get_string('showblocka', 'access', $title));
-    $strhide = addslashes_js(get_string('hideblocka', 'access', $title));
+    $strshow = addslashes_js(get_string('showblocka', 'access', strip_tags($title)));
+    $strhide = addslashes_js(get_string('hideblocka', 'access', strip_tags($title)));
 
     // IE workaround: if I do it THIS way, it works! WTF?
     if (!empty($CFG->allowuserblockhiding) && isset($attributes['id'])) {