manual grading: MDL-20581 Fix potential XSS problem.

Thanks to Penny for spotting this.
Merged from MOODLE_19_STABLE.

diff --git a/mod/quiz/db/access.php b/mod/quiz/db/access.php
index ff9fb90f120a7355c4f89649567f7baa43e2808f..ea55aff9b7d88eb8c43b7e52ccdcaabe87f658c6 100644 (file)
--- a/mod/quiz/db/access.php
+++ b/mod/quiz/db/access.php
@@ -65,7 +65,7 @@ $capabilities = array(
 
     // Manually grade and comment on student attempts at a question.
     'mod/quiz:grade' => array(
-        'riskbitmask' => RISK_SPAM | RISK_XSS,
+        'riskbitmask' => RISK_SPAM,
         'captype' => 'write',
         'contextlevel' => CONTEXT_MODULE,
         'legacy' => array(
@@ -77,7 +77,7 @@ $capabilities = array(
 
     // Regrade quizzes.
     'mod/quiz:regrade' => array(
-        'riskbitmask' => RISK_SPAM | RISK_XSS,
+        'riskbitmask' => RISK_SPAM,
         'captype' => 'write',
         'contextlevel' => CONTEXT_MODULE,
         'legacy' => array(

diff --git a/mod/quiz/version.php b/mod/quiz/version.php
index 1503d351b83fb860ac6931262f0ea37fe29b6018..0f229bd574133a4c72491760c12aa7e07837b9ca 100644 (file)
--- a/mod/quiz/version.php
+++ b/mod/quiz/version.php
@@ -5,7 +5,7 @@
 //  This fragment is called by moodle_needs_upgrading() and /admin/index.php
 ////////////////////////////////////////////////////////////////////////////////
 
-$module->version  = 2009042000;   // The (date) version of this module
+$module->version  = 2009111900;   // The (date) version of this module
 $module->requires = 2009041700;   // Requires this Moodle version
 $module->cron     = 0;            // How often should cron check this module (seconds)?
 

diff --git a/question/type/questiontype.php b/question/type/questiontype.php
index e683167d5935596cdcf5ecb3a5adc549c8832963..d803a97e90d63e394d11e2dfbbfa03c0e241f041 100644 (file)
--- a/question/type/questiontype.php
+++ b/question/type/questiontype.php
@@ -946,7 +946,10 @@ class default_questiontype {
             $grade .= question_format_grade($cmoptions, $question->maxgrade);
         }
 
-        $comment = $state->manualcomment;
+        $formatoptions = new stdClass;
+        $formatoptions->para = false;
+        $comment = format_text($state->manualcomment, FORMAT_HTML,
+                $formatoptions, $cmoptions->course);
         $commentlink = '';
 
         if (!empty($options->questioncommentlink)) {