MDL-17236 html block: proper cleanup of html

diff --git a/blocks/html/block_html.php b/blocks/html/block_html.php
index 2086c49f11c3b6874a8e23ecda2f485ca3d9b2a3..e7c0aebe6e182731420756faff4c43a5a27b990f 100755 (executable)
--- a/blocks/html/block_html.php
+++ b/blocks/html/block_html.php
@@ -24,8 +24,13 @@ class block_html extends block_base {
             return $this->content;
         }
 
-        $filteropt = new stdClass;
-        $filteropt->noclean = true;
+        if (!empty($this->instance->pinned) or $this->instance->pagetype === 'course-view') {
+            // fancy html allowed only on course page and in pinned blocks for security reasons
+            $filteropt = new stdClass;
+            $filteropt->noclean = true;
+        } else {
+            $filteropt = null;
+        }
 
         $this->content = new stdClass;
         $this->content->text = isset($this->config->text) ? format_text($this->config->text, FORMAT_HTML, $filteropt) : '';

diff --git a/blocks/html/config_instance.html b/blocks/html/config_instance.html
index 6352ee80e45f146541ed75c28ba012acafbc9acb..0d5feabc6fe4eb0bd3130641a009e846d0d938e8 100755 (executable)
--- a/blocks/html/config_instance.html
+++ b/blocks/html/config_instance.html
@@ -1,4 +1,11 @@
-<?php $usehtmleditor = can_use_html_editor(); ?>
+<?php
+    $usehtmleditor = can_use_html_editor();
+
+    $text = isset($this->config->text) ? $this->config->text : '';
+    if (empty($this->instance->pinned) and $this->instance->pagetype !== 'course-view') {
+        $text = clean_text($text, FORMAT_HTML);
+    }
+?>
 <table cellpadding="9" cellspacing="0">
 <tr valign="top">
     <td align="right"><?php print_string('configtitle', 'block_html'); ?>:</td>
@@ -6,7 +13,7 @@
 </tr>
 <tr valign="top">
     <td align="right"><?php print_string('configcontent', 'block_html'); ?>:</td>
-    <td><?php print_textarea($usehtmleditor, 25, 50, 0, 0, 'text', isset($this->config->text)?$this->config->text:'') ?></td>
+    <td><?php print_textarea($usehtmleditor, 25, 50, 0, 0, 'text', $text) ?></td>
 </tr>
 <tr>
     <td colspan="3" align="center">