user selector: MDL-16996- followup - change optgroup label escaping funciton to keep...

diff --git a/user/selector/lib.php b/user/selector/lib.php
index 2a6cd8014e09e7a6ebee8529badf30d2cb33f952..886f6a24584fe511338efdd287bce337ad47f240 100644 (file)
--- a/user/selector/lib.php
+++ b/user/selector/lib.php
@@ -427,7 +427,7 @@ abstract class user_selector_base {
      */
     protected function output_optgroup($groupname, $users, $select) {
         if (!empty($users)) {
-            $output = '  <optgroup label="' . s($groupname) . ' (' . count($users) . ')">' . "\n";
+            $output = '  <optgroup label="' . htmlspecialchars($groupname) . ' (' . count($users) . ')">' . "\n";
             foreach ($users as $user) {
                 $attributes = '';
                 if (!empty($user->disabled)) {
@@ -440,7 +440,7 @@ abstract class user_selector_base {
                         $this->output_user($user) . "</option>\n";
             }
         } else {
-            $output = '  <optgroup label="' . s($groupname) . '">' . "\n";
+            $output = '  <optgroup label="' . htmlspecialchars($groupname) . '">' . "\n";
             $output .= '    <option disabled="disabled">&nbsp;</option>' . "\n";
         }
         $output .= "  </optgroup>\n";