MDL-10341 fixed user search cleaning; merged from MOODLE_18_STABLE

diff --git a/user/index.php b/user/index.php
index f195321d272b28ef372c1326a50d57f62b91208c..1beca2599b9caa209f2a8325e871c91352540194 100644 (file)
--- a/user/index.php
+++ b/user/index.php
@@ -134,7 +134,7 @@
     }
 
     // Should use this variable so that we don't break stuff every time a variable is added or changed.
-    $baseurl = $CFG->wwwroot.'/user/index.php?contextid='.$context->id.'&roleid='.$roleid.'&id='.$course->id.'&group='.$currentgroup.'&perpage='.$perpage.'&accesssince='.$accesssince.'&search='.$search;
+    $baseurl = $CFG->wwwroot.'/user/index.php?contextid='.$context->id.'&roleid='.$roleid.'&id='.$course->id.'&group='.$currentgroup.'&perpage='.$perpage.'&accesssince='.$accesssince.'&search='.s($search);
 
 /// Print headers
 
@@ -613,7 +613,7 @@
 
     if ($bulkoperations && $totalcount > ($perpage*3)) {
         echo '<form action="index.php"><div><input type="hidden" name="id" value="'.$course->id.'" />'.get_string('search').':&nbsp;'."\n";
-        echo '<input type="text" name="search" value="'.$search.'" />&nbsp;<input type="submit" value="'.get_string('search').'" /></div></form>'."\n";
+        echo '<input type="text" name="search" value="'.s($search).'" />&nbsp;<input type="submit" value="'.get_string('search').'" /></div></form>'."\n";
     }
 
     $perpageurl = preg_replace('/&amp;perpage=\d*/','', $baseurl);