diff --git a/main/wiki/index.php b/main/wiki/index.php index 8e3af568f6..3fbd1a190f 100644 --- a/main/wiki/index.php +++ b/main/wiki/index.php @@ -291,7 +291,7 @@ if ($_GET['view']) { Display::display_normal_message($is_being_edited, false); } else { - Display::display_confirmation_message(restore_wikipage($current_row['page_id'], $current_row['reflink'], mysql_real_escape_string($current_row['title']), mysql_real_escape_string($current_row['content']), $current_row['group_id'], $current_row['assignment'], $current_row['progress'], $current_row['version'], $last_row['version'], $current_row['linksto']).': '.api_htmlentities($last_row['title']).'',false); + Display::display_confirmation_message(restore_wikipage($current_row['page_id'], $current_row['reflink'], api_htmlentities($current_row['title']), api_htmlentities($current_row['content']), $current_row['group_id'], $current_row['assignment'], $current_row['progress'], $current_row['version'], $last_row['version'], $current_row['linksto']).': '.api_htmlentities($last_row['title']).'',false); } } } @@ -1680,9 +1680,9 @@ if ($_GET['action']=='edit') { $title=get_lang('DefaultTitle'); $page_id=0; } else { - $content=$row['content']; - $title=$row['title']; - $page_id=$row['page_id']; + $content = api_html_entity_decode($row['content']); + $title = api_html_entity_decode($row['title']); + $page_id = $row['page_id']; } //Only teachers and platform admin can edit the index page. Only teachers and platform admin can edit an assignment teacher. And users in groups diff --git a/main/wiki/wiki.inc.php b/main/wiki/wiki.inc.php index 84654b34d6..6372e600a8 100644 --- a/main/wiki/wiki.inc.php +++ b/main/wiki/wiki.inc.php @@ -807,8 +807,8 @@ function display_wiki_entry($newtitle) { return Display::display_normal_message(get_lang('WikiStandBy')); } } else { - $content=Security::remove_XSS($row['content'],COURSEMANAGERLOWSECURITY); - $title= $row['title']; + $content=Security::remove_XSS(api_html_entity_decode($row['content']),COURSEMANAGERLOWSECURITY); + $title= api_html_entity_decode($row['title']); } //assignment mode: identify page type