From 8a82d2d4d8451518cb2eaa3f702775636df3ff82 Mon Sep 17 00:00:00 2001
From: jmontoyaa <gugli100@gmail.com>
Date: Fri, 8 Sep 2017 10:36:55 +0200
Subject: [PATCH] Fix blocking videos in course description see #2133

---
 main/course_description/listing.php     | 50 +++++++++++++++++++++----
 main/inc/lib/course_description.lib.php |  6 +--
 2 files changed, 44 insertions(+), 12 deletions(-)

diff --git a/main/course_description/listing.php b/main/course_description/listing.php
index 62146aeb79..3f712ddede 100755
--- a/main/course_description/listing.php
+++ b/main/course_description/listing.php
@@ -24,11 +24,23 @@ if (api_is_allowed_to_edit(null, true)) {
     foreach ($categories as $id => $title) {
         if ($i == ADD_BLOCK) {
             echo '<a href="index.php?'.api_get_cidreq().'&action=add">'.
-                Display::return_icon($default_description_icon[$id], $title, '', ICON_SIZE_MEDIUM).'</a>';
+                Display::return_icon(
+                    $default_description_icon[$id],
+                    $title,
+                    '',
+                    ICON_SIZE_MEDIUM
+                ).
+                '</a>';
             break;
         } else {
             echo '<a href="index.php?action=edit&'.api_get_cidreq().'&description_type='.$id.'">'.
-                Display::return_icon($default_description_icon[$id], $title, '', ICON_SIZE_MEDIUM).'</a>';
+                Display::return_icon(
+                    $default_description_icon[$id],
+                    $title,
+                    '',
+                    ICON_SIZE_MEDIUM
+                ).
+                '</a>';
             $i++;
         }
     }
@@ -42,8 +54,14 @@ if ($history) {
         <table width="100%">
             <tr>
                 <td><h3>'.get_lang('ThematicAdvanceHistory').'</h3></td>
-                <td align="right"><a href="index.php?action=listing">'.
-                Display::return_icon('info.png', get_lang('BackToCourseDesriptionList'), array('style'=>'vertical-align:middle;'), ICON_SIZE_SMALL).' '.get_lang('BackToCourseDesriptionList').'</a></td></tr></table></div>';
+                <td align="right"><a href="index.php?action=listing">';
+    echo Display::return_icon(
+        'info.png',
+        get_lang('BackToCourseDesriptionList'),
+        array('style' => 'vertical-align:middle;'),
+        ICON_SIZE_SMALL
+    );
+    echo ' '.get_lang('BackToCourseDesriptionList').'</a></td></tr></table></div>';
 }
 
 $user_info = api_get_user_info();
@@ -58,19 +76,35 @@ if (isset($descriptions) && count($descriptions) > 0) {
 
                     // delete
                     $actions .= '<a href="'.api_get_self().'?id='.$description['id'].'&'.api_get_cidreq_params(api_get_course_id(), $description['session_id']).'&action=delete&description_type='.$description['description_type'].'" onclick="javascript:if(!confirm(\''.addslashes(api_htmlentities(get_lang('ConfirmYourChoice'), ENT_QUOTES, api_get_system_encoding())).'\')) return false;">';
-                    $actions .= Display::return_icon('delete.png', get_lang('Delete'), array('style' => 'vertical-align:middle;float:right;'), ICON_SIZE_SMALL);
+                    $actions .= Display::return_icon(
+                        'delete.png',
+                        get_lang('Delete'),
+                        array('style' => 'vertical-align:middle;float:right;'),
+                        ICON_SIZE_SMALL
+                    );
                     $actions .= '</a> ';
 
                     // edit
                     $actions .= '<a href="'.api_get_self().'?id='.$description['id'].'&'.api_get_cidreq_params(api_get_course_id(), $description['session_id']).'&action=edit&description_type='.$description['description_type'].'">';
-                    $actions .= Display::return_icon('edit.png', get_lang('Edit'), array('style' => 'vertical-align:middle;float:right; padding-right:4px;'), ICON_SIZE_SMALL);
+                    $actions .= Display::return_icon(
+                        'edit.png',
+                        get_lang('Edit'),
+                        array('style' => 'vertical-align:middle;float:right; padding-right:4px;'),
+                        ICON_SIZE_SMALL
+                    );
                     $actions .= '</a> ';
                 } else {
-                    $actions .= Display::return_icon('edit_na.png', get_lang('EditionNotAvailableFromSession'), array('style' => 'vertical-align:middle;float:right;'), ICON_SIZE_SMALL);
+                    $actions .= Display::return_icon(
+                        'edit_na.png',
+                        get_lang('EditionNotAvailableFromSession'),
+                        array('style' => 'vertical-align:middle;float:right;'),
+                        ICON_SIZE_SMALL
+                    );
                 }
             }
+
             echo Display::panel(
-                $description['content'],
+                Security::remove_XSS($description['content']),
                 "<div class='pull-right'>$actions</div>{$description['title']}",
                 '',
                 'info'
diff --git a/main/inc/lib/course_description.lib.php b/main/inc/lib/course_description.lib.php
index 221077d220..7a45dddde8 100755
--- a/main/inc/lib/course_description.lib.php
+++ b/main/inc/lib/course_description.lib.php
@@ -57,6 +57,7 @@ class CourseDescription
             $desc_tmp = new CourseDescription();
             $desc_tmp->set_id($row['id']);
             $desc_tmp->set_title($row['title']);
+
             $desc_tmp->set_content($row['content']);
             $desc_tmp->set_session_id($row['session_id']);
             $desc_tmp->set_description_type($row['description_type']);
@@ -87,10 +88,7 @@ class CourseDescription
         $rs = Database::query($sql);
         $data = array();
         while ($description = Database::fetch_array($rs)) {
-            $data['descriptions'][$description['id']] = Security::remove_XSS(
-                $description,
-                STUDENT
-            );
+            $data['descriptions'][$description['id']] = $description;
         }
 
         return $data;