[svn r20649] minor remove_xss in gradebook and link see FS#4169

main/gradebook/lib/be/evaluation.class.php

@@ -222,13 +222,13 @@ class Evaluation implements GradebookItem
 			if (isset($this->eval_date)) {
 			  $sql .= ',date';
 			}
-			$sql .= ") VALUES ('".Database::escape_string($this->get_name())."'"
+			$sql .= ") VALUES ('".Database::escape_string(Security::remove_XSS($this->get_name()))."'"
 					.','.$this->get_user_id()
 					.','.$this->get_weight()
 					.','.$this->get_max()
 					.','.$this->is_visible();
 			if (isset($this->description)) {
-				 $sql .= ",'".Database::escape_string($this->get_description())."'";
+				 $sql .= ",'".Database::escape_string(Security::remove_XSS($this->get_description()))."'";
 			}
 			if (isset($this->course_code)) {
 				 $sql .= ",'".$this->get_course_code()."'";
@@ -267,10 +267,10 @@ class Evaluation implements GradebookItem
 	public function save() {
 		$tbl_grade_evaluations = Database :: get_main_table(TABLE_MAIN_GRADEBOOK_EVALUATION);
 		$sql = 'UPDATE '.$tbl_grade_evaluations
-			." SET name = '".Database::escape_string($this->get_name())."'"
+			." SET name = '".Database::escape_string(Security::remove_XSS($this->get_name()))."'"
 			.', description = ';
 		if (isset($this->description)) {
-			$sql .= "'".Database::escape_string($this->get_description())."'";			
+			$sql .= "'".Database::escape_string(Security::remove_XSS($this->get_description()))."'";			
 		}else {
 			$sql .= 'null';		
 		}

main/link/linkfunctions.php

@@ -188,24 +188,19 @@ function addlinkcategory($type)
 
 			Display::display_confirmation_message(get_lang('LinkAdded'));
 		}
-	}
+	} elseif ($type == "category") {
-	elseif ($type == "category")
-	{
 		$tbl_categories = Database :: get_course_table(TABLE_LINK_CATEGORY);
 
 		$category_title = trim($_POST['category_title']);
 		$description = trim($_POST['description']);
 
-		if (empty ($category_title))
+		if (empty ($category_title)) {
-		{
 			$msgErr = get_lang('GiveCategoryName');
 
 			Display::display_error_message(get_lang('GiveCategoryName'));
 
 			$ok = false;
-		}
+		} else {
-		else
-		{
 			// looking for the largest order number for this category
 			$result = api_sql_query("SELECT MAX(display_order) FROM  ".$tbl_categories."");
 
@@ -213,7 +208,7 @@ function addlinkcategory($type)
 
 			$order = $orderMax +1;
 
-			$sql = "INSERT INTO ".$tbl_categories." (category_title, description, display_order) VALUES ('$category_title','$description', '$order')";
+			$sql = "INSERT INTO ".$tbl_categories." (category_title, description, display_order) VALUES ('".Security::remove_XSS($category_title)."','".Security::remove_XSS($description)."', '$order')";
 			api_sql_query($sql, __FILE__, __LINE__);
 
 			$catlinkstatus = get_lang('CategoryAdded');