Fixed problem with slashes, bug 5177

diff --git a/lib/questionlib.php b/lib/questionlib.php
index 5e07530549f857bd3fe408c1f4eaf864bd57705c..90f6b22863be471cff81450345f579fad226c363 100644 (file)
--- a/lib/questionlib.php
+++ b/lib/questionlib.php
@@ -645,8 +645,10 @@ function restore_question_state(&$question, &$state) {
     global $QTYPES;
 
     // initialise response to the value in the answer field
+    $state->answer = addslashes($state->answer);
     $state->responses = array('' => $state->answer);
     unset($state->answer);
+    $state->comment = isset($state->comment) ? addslashes($state->comment) : '';
 
     // Set the changed field to false; any code which changes the
     // question session must set this to true and must increment

diff --git a/question/type/essay/questiontype.php b/question/type/essay/questiontype.php
index 82309608411ae4eb68bdc839f7d7a3767e730bf5..4846590da25abfa6498e908bf4254ee8da91606d 100644 (file)
--- a/question/type/essay/questiontype.php
+++ b/question/type/essay/questiontype.php
@@ -110,7 +110,7 @@ class question_essay_qtype extends default_questiontype {
         // get response value
         if (isset($state->responses[''])) { 
             // security problem. responses[''] is never cleaned before it is sent to the db (I think)
-            $value = $state->responses[''];            
+            $value = stripslashes_safe($state->responses['']);            
         } else {
             $value = "";
         }

diff --git a/question/type/questiontype.php b/question/type/questiontype.php
index 3bed76d117afe927ffeff11d087f0e1bb6d5fea1..920638ab2666ca2bc5c5fd66928db57cfa8e35f0 100644 (file)
--- a/question/type/questiontype.php
+++ b/question/type/questiontype.php
@@ -475,7 +475,7 @@ class default_questiontype {
             $grade .= $question->maxgrade;
         }
         
-        $comment = $state->comment;
+        $comment = stripslashes($state->comment);
         $commentlink = '';
         if (isset($options->questioncommentlink)) {
             $strcomment = get_string('commentorgrade', 'quiz');