chamilo
/
chamilo-lms
mirror of https://github.com/chamilo/chamilo-lms/tree/1.11.x
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

Exercises: add remove_xss

Browse Source
pull/3937/head^2
Julio Montoya 4 years ago
parent 9815db1ff9
commit aa359f9df6
7 changed files with 24 additions and 36 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 8
      main/exercise/TestCategory.php
  2. 6
      main/exercise/admin.php
  3. 4
      main/exercise/exercise.class.php
  4. 24
      main/exercise/exercise_submit.php
  5. 8
      main/exercise/overview.php
  6. 6
      main/inc/lib/exercise.lib.php
  7. 4
      main/template/default/exercise/partials/result_exercise.tpl

8
main/exercise/TestCategory.php
Unescape View File

@ -499,7 +499,7 @@ class TestCategory
$categories = self::getCategoryListInfo('', $courseId);
$result = ['0' => get_lang('NoCategorySelected')];
for ($i = 0; $i < count($categories); $i++) {
$result[$categories[$i]->iid] = $categories[$i]->name;
$result[$categories[$i]->iid] = Security::remove_XSS($categories[$i]->name);
}
return $result;
@ -677,7 +677,7 @@ class TestCategory
($in_display_category_name == 1 || !$is_student)
) {
$content .= '<div class="page-header">';
$content .= '<h4>'.get_lang('Category').": ".self::getCategoryNameForQuestion($questionId).'</h4>';
$content .= '<h4>'.get_lang('Category').": ".Security::remove_XSS(self::getCategoryNameForQuestion($questionId)).'</h4>';
$content .= "</div>";
}
@ -1239,7 +1239,7 @@ class TestCategory
$nb_question_label = $nb_question == 1 ? $nb_question.' '.get_lang('Question') : $nb_question.' '.get_lang('Questions');
$content = "<span style='float:right'>".$nb_question_label."</span>";
$content .= '<div class="sectioncomment">';
$content .= $category['description'];
$content .= Security::remove_XSS($category['description']);
$content .= '</div>';
$links = '';
@ -1251,7 +1251,7 @@ class TestCategory
$links .= Display::return_icon('delete.png', get_lang('Delete'), [], ICON_SIZE_SMALL).'</a>';
}
$html .= Display::panel($content, $category['title'].$links);
$html .= Display::panel($content, Security::remove_XSS($category['title']).$links);
}
return $html;

6
main/exercise/admin.php
Unescape View File

@ -277,12 +277,12 @@ $interbreadcrumb[] = ['url' => 'exercise.php?'.api_get_cidreq(), 'name' => get_l
if (isset($_GET['newQuestion']) || isset($_GET['editQuestion'])) {
$interbreadcrumb[] = [
'url' => 'admin.php?exerciseId='.$objExercise->iid.'&'.api_get_cidreq(),
'name' => $objExercise->selectTitle(true),
'name' => Security::remove_XSS($objExercise->selectTitle(true)),
];
} else {
$interbreadcrumb[] = [
'url' => '#',
'name' => $objExercise->selectTitle(true),
'name' => Security::remove_XSS($objExercise->selectTitle(true)),
];
}
@ -445,7 +445,7 @@ if ($newQuestion || $editQuestion) {
// Question preview if teacher clicked the "switch to student"
if ($studentViewActive && $is_allowedToEdit) {
echo '<div class="main-question">';
echo Display::div($objQuestion->selectTitle(), ['class' => 'question_title']);
echo Display::div(Security::remove_XSS($objQuestion->selectTitle()), ['class' => 'question_title']);
ExerciseLib::showQuestion(
$objExercise,
$editQuestion,

4
main/exercise/exercise.class.php
Unescape View File

@ -6524,9 +6524,9 @@ class Exercise
}
if (api_get_configuration_value('save_titles_as_html')) {
$data['title'] = $this->get_formated_title().get_lang('Result');
$data['title'] = Security::remove_XSS($this->get_formated_title()).get_lang('Result');
} else {
$data['title'] = PHP_EOL.$this->exercise.' : '.get_lang('Result');
$data['title'] = PHP_EOL.Security::remove_XSS($this->exercise).' : '.get_lang('Result');
}
$questionsCount = count(explode(',', $trackExerciseInfo['data_tracking']));

24
main/exercise/exercise_submit.php
Unescape View File

@ -200,7 +200,7 @@ if ('true' === api_get_plugin_setting('positioning', 'tool_enable')) {
}
// if the user has submitted the form.
$exercise_title = $objExercise->selectTitle();
$exercise_title = Security::remove_XSS($objExercise->selectTitle());
$exercise_sound = $objExercise->selectSound();
// If reminder ends we jump to the exercise_reminder
@ -659,12 +659,6 @@ if ($allowBlockCategory &&
}
$count++;
}
//var_dump($questionCheck);exit;
// Use reminder list to get the current question.
/*if (2 === $reminder && !empty($myRemindList)) {
$remindQuestionId = current($myRemindList);
$questionCheck = Question::read($remindQuestionId);
}*/
$categoryId = 0;
if (null !== $questionCheck) {
@ -674,12 +668,12 @@ if ($allowBlockCategory &&
if ($objExercise->review_answers && isset($_GET['category_id'])) {
$categoryId = $_GET['category_id'] ?? 0;
}
//var_dump($categoryId, $categoryList);
if (!empty($categoryId)) {
$categoryInfo = $categoryList[$categoryId];
$count = 1;
$total = count($categoryList[$categoryId]);
//var_dump($questionCheck);
foreach ($categoryList[$categoryId] as $checkQuestionId) {
if ((int) $checkQuestionId === (int) $questionCheck->iid) {
break;
@ -687,7 +681,6 @@ if ($allowBlockCategory &&
$count++;
}
//var_dump($count , $total);
if ($count === $total) {
$isLastQuestionInCategory = $categoryId;
if ($isLastQuestionInCategory) {
@ -717,8 +710,7 @@ if ($allowBlockCategory &&
api_location($url);
}
}
//exit;
//var_dump($isLastQuestionInCategory);
if ($debug) {
error_log('8. Question list loaded '.print_r($questionList, 1));
}
@ -728,7 +720,7 @@ $question_count = 0;
if (!empty($questionList)) {
$question_count = count($questionList);
}
//var_dump($current_question);
if ($current_question > $question_count) {
// If time control then don't change the current question, otherwise there will be a loop.
// @todo
@ -738,10 +730,6 @@ if ($current_question > $question_count) {
}
if ($formSent && isset($_POST)) {
if ($debug) {
error_log('9. $formSent was set');
}
if (!is_array($exerciseResult)) {
$exerciseResult = [];
$exerciseResultCoordinates = [];
@ -1701,7 +1689,7 @@ foreach ($questionList as $questionId) {
if ($objExercise->type == ONE_PER_PAGE || ($objExercise->type != ONE_PER_PAGE && $i == 1)) {
echo Display::panelCollapse(
'<span>'.get_lang('ExerciseDescriptionLabel').'</span>',
$objExercise->description,
Security::remove_XSS($objExercise->description),
'exercise-description',
[],
'description',

8
main/exercise/overview.php
Unescape View File

@ -52,7 +52,7 @@ $interbreadcrumb[] = [
'url' => 'exercise.php?'.api_get_cidreq(),
'name' => get_lang('Exercises'),
];
$interbreadcrumb[] = ['url' => '#', 'name' => $objExercise->selectTitle(true)];
$interbreadcrumb[] = ['url' => '#', 'name' => Security::remove_XSS($objExercise->selectTitle(true))];
$time_control = false;
$clock_expired_time = ExerciseLib::get_session_time_control_key($objExercise->iid, $learnpath_id, $learnpath_item_id);
@ -122,17 +122,17 @@ $iconExercise = Display::return_icon('test-quiz.png', null, [], ICON_SIZE_MEDIUM
// Exercise name.
if (api_get_configuration_value('save_titles_as_html')) {
$html .= Display::div(
$objExercise->get_formated_title().PHP_EOL.$editLink
Security::remove_XSS($objExercise->get_formated_title()).PHP_EOL.$editLink
);
} else {
$html .= Display::page_header(
$iconExercise.PHP_EOL.$objExercise->selectTitle().PHP_EOL.$editLink
$iconExercise.PHP_EOL.Security::remove_XSS($objExercise->selectTitle()).PHP_EOL.$editLink
);
}
// Exercise description.
if (!empty($objExercise->description)) {
$html .= Display::div($objExercise->description, ['class' => 'exercise_description']);
$html .= Display::div(Security::remove_XSS($objExercise->description), ['class' => 'exercise_description']);
}
$exercise_stat_info = $objExercise->get_stat_track_exercise_info(

6
main/inc/lib/exercise.lib.php
Unescape View File

@ -84,7 +84,7 @@ class ExerciseLib
if ($exercise->display_category_name) {
TestCategory::displayCategoryAndTitle($objQuestionTmp->iid);
}
$titleToDisplay = $objQuestionTmp->getTitleToDisplay($current_item);
$titleToDisplay = Security::remove_XSS($objQuestionTmp->getTitleToDisplay($current_item));
if ($answerType == READING_COMPREHENSION) {
// In READING_COMPREHENSION, the title of the question
// contains the question itself, which can only be
@ -4846,7 +4846,7 @@ EOT;
}
// Display text when test is finished #4074 and for LP #4227
$endOfMessage = $objExercise->getTextWhenFinished();
$endOfMessage = Security::remove_XSS($objExercise->getTextWhenFinished());
if (!empty($endOfMessage)) {
echo Display::div(
$endOfMessage,
@ -5173,7 +5173,7 @@ EOT;
if (api_get_configuration_value('quiz_show_description_on_results_page') &&
!empty($objExercise->description)
) {
echo Display::div($objExercise->description, ['class' => 'exercise_description']);
echo Display::div(Security::remove_XSS($objExercise->description), ['class' => 'exercise_description']);
}
echo $exercise_content;

4
main/template/default/exercise/partials/result_exercise.tpl
Unescape View File

@ -2,9 +2,9 @@
<div class="panel panel-default">
<div class="panel-body">
{% if 'save_titles_as_html'|api_get_configuration_value %}
{{ data.title }}
{{ data.title | remove_xss }}
{% else %}
<h3>{{ data.title }}</h3>
<h3>{{ data.title | remove_xss }}</h3>
{% endif %}
<div class="row">

Write Preview
Loading…
Cancel
Save