Merge

main/exercice/exercise.lib.php

@@ -105,7 +105,7 @@ function showQuestion($questionId, $onlyAnswers=false, $origin=false,$current_it
 		// construction of the Answer object
 		$objAnswerTmp=new Answer($questionId);
 
-		$nbrAnswers=$objAnswerTmp->selectNbrAnswers();
+		$nbrAnswers=$objAnswerTmp->selectNbrAnswers(); 
 
 		// only used for the answer type "Matching"
 		if($answerType == MATCHING)
@@ -232,7 +232,7 @@ function showQuestion($questionId, $onlyAnswers=false, $origin=false,$current_it
 					<p style='float:left; padding-right:4px;'>
 					<span><input class='checkbox' type='radio' name='choice[".$questionId."]' value='".$numAnswer."'></p></span>";
                     $answer=api_parse_tex($answer);
-                    $s.=strip_tags($answer);
+                    $s.=Security::remove_XSS($answer, STUDENT);                    
                     $s.="</div></td></tr>";
 
 			} elseif($answerType == MULTIPLE_ANSWER) {
@@ -244,7 +244,7 @@ function showQuestion($questionId, $onlyAnswers=false, $origin=false,$current_it
 					 <p style='float:left; padding-right:4px;'>
 					 <span><input class='checkbox' type='checkbox' name='choice[".$questionId."][".$numAnswer."]' value='1'></p></span>";
 				$answer = api_parse_tex($answer);
-				$s.=strip_tags($answer);
+				$s.=Security::remove_XSS($answer, STUDENT);
 				$s.="</div></td></tr>";			
 				
 			} elseif($answerType == MULTIPLE_ANSWER_COMBINATION) {
@@ -256,20 +256,17 @@ function showQuestion($questionId, $onlyAnswers=false, $origin=false,$current_it
 					 <p style='float:left; padding-right:4px;'>
 					 <span><input class='checkbox' type='checkbox' name='choice[".$questionId."][".$numAnswer."]' value='1'></p></span>";
 				$answer = api_parse_tex($answer);
-				$s.=strip_tags($answer);
+				$s.=Security::remove_XSS($answer, STUDENT);
 				$s.="</div></td></tr>";
 			}
-
 			// fill in blanks
-			elseif($answerType == FILL_IN_BLANKS)
-			{
+			elseif($answerType == FILL_IN_BLANKS) {
 				$s.="<tr><td colspan='2'>$answer</td></tr>";
 			}
 			// free answer
 
 			// matching // TODO: replace $answerId by $numAnswer
-			else {
-				
+			else {				
 				if ($answerCorrect) {
 					$s.="
 					<tr>