Merged parameter cleaning from stable

diff --git a/lib/weblib.php b/lib/weblib.php
index a66faefcfbc2ecab3804b22811b11b17d38f06d5..706efa7f65e64af5dd1a51ebd2b669ec1f3f577c 100644 (file)
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -2977,6 +2977,9 @@ function emoticonhelpbutton($form, $field) {
 function notice ($message, $link='') {
     global $CFG, $THEME;
 
+    $message = clean_text($message);
+    $link    = clean_text($link);
+
     if (!$link) {
         if (!empty($_SERVER['HTTP_REFERER'])) {
             $link = $_SERVER['HTTP_REFERER'];
@@ -3003,6 +3006,10 @@ function notice ($message, $link='') {
 function notice_yesno ($message, $linkyes, $linkno) {
     global $THEME;
 
+    $message = clean_text($message);
+    $linkyes = clean_text($linkyes);
+    $linkno = clean_text($linkno);
+
     print_simple_box_start('center', '60%', $THEME->cellheading);
     echo '<p align="center"><font size="3">'. $message .'</font></p>';
     echo '<p align="center"><font size="3"><strong>';
@@ -3024,11 +3031,15 @@ function notice_yesno ($message, $linkyes, $linkno) {
  *      first decode all entities in $url (since we cannot rely on)
  *      the correct input) and then encode for where it's needed
  *      echo "<script type='text/javascript'>alert('Redirect $url');</script>";
-
  */
 function redirect($url, $message='', $delay='0') {
+
+    $url     = clean_text($url);
+    $message = clean_text($message);
+ 
     $url = html_entity_decode($url); // for php < 4.3.0 this is defined in moodlelib.php
     $encodedurl = htmlentities($url);
+
     if (empty($message)) {
         echo '<meta http-equiv="refresh" content="'. $delay .'; url='. $encodedurl .'" />';
         echo '<script type="text/javascript">'. "\n" .'<!--'. "\n". "location.replace('$url');". "\n". '//-->'. "\n". '</script>';   // To cope with Mozilla bug
@@ -3056,6 +3067,9 @@ function redirect($url, $message='', $delay='0') {
  * @param string $align Paragraph alignment option
  */
 function notify ($message, $color='red', $align='center') {
+
+    $message = clean_text($message);
+
     echo '<p align="'. $align .'"><strong><font color="'. $color .'">'. $message .'</font></strong></p>' . "\n";
 }