Skip to content

Commit ac1b472

Browse files
committed
LPs: Add remove_Xss
1 parent 78f74d3 commit ac1b472

File tree

2 files changed

+19
-11
lines changed

2 files changed

+19
-11
lines changed

main/inc/lib/document.lib.php

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6962,7 +6962,7 @@ private static function parseFile(
69626962
$icon = choose_image($path);
69636963
$position = strrpos($icon, '.');
69646964
$icon = substr($icon, 0, $position).'_small.gif';
6965-
$my_file_title = $resource['title'];
6965+
$my_file_title = Security::remove_XSS($resource['title']);
69666966
$visibility = $resource['visibility'];
69676967

69686968
// If title is empty we try to use the path
@@ -7083,7 +7083,6 @@ private static function parseFolder($folderId, $resource, $lp_id)
70837083
return null;
70847084
}
70857085

7086-
//$onclick = '';
70877086
// if in LP, hidden folder are displayed in grey
70887087
$folder_class_hidden = '';
70897088
if ($lp_id) {
@@ -7098,15 +7097,27 @@ private static function parseFolder($folderId, $resource, $lp_id)
70987097
$return = '<ul class="lp_resource">';
70997098
}
71007099

7101-
$return .= '<li class="doc_folder'.$folder_class_hidden.'" id="doc_id_'.$resource['id'].'" style="margin-left:'.($num * 18).'px; ">';
7100+
$return .= '<li
7101+
class="doc_folder'.$folder_class_hidden.'"
7102+
id="doc_id_'.$resource['id'].'"
7103+
style="margin-left:'.($num * 18).'px;"
7104+
>';
71027105

71037106
$image = Display::returnIconPath('nolines_plus.gif');
71047107
if (empty($path)) {
71057108
$image = Display::returnIconPath('nolines_minus.gif');
71067109
}
7107-
$return .= '<img style="cursor: pointer;" src="'.$image.'" align="absmiddle" id="img_'.$resource['id'].'" '.$onclick.'>';
7110+
$return .= '<img
7111+
style="cursor: pointer;"
7112+
src="'.$image.'"
7113+
align="absmiddle"
7114+
id="img_'.$resource['id'].'" '.$onclick.'
7115+
>';
7116+
71087117
$return .= Display::return_icon('lp_folder.gif').'&nbsp;';
7109-
$return .= '<span '.$onclick.' style="cursor: pointer;" >'.$title.'</span>';
7118+
$return .= '<span '.$onclick.' style="cursor: pointer;" >'.
7119+
Security::remove_XSS($title).
7120+
'</span>';
71107121
$return .= '</li>';
71117122

71127123
if (empty($path)) {

main/lp/learnpath.class.php

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3539,7 +3539,7 @@ public function get_name()
35393539
*/
35403540
public function getNameNoTags()
35413541
{
3542-
return strip_tags($this->get_name());
3542+
return Security::remove_XSS(strip_tags($this->get_name()));
35433543
}
35443544

35453545
/**
@@ -6642,7 +6642,7 @@ public function return_new_tree($update_audio = 'false', $drop_element_here = fa
66426642
$list .= '</ul>';
66436643

66446644
$return = Display::panelCollapse(
6645-
$this->name,
6645+
$this->getNameNoTags(),
66466646
$list,
66476647
'scorm-list',
66486648
null,
@@ -7585,7 +7585,6 @@ public function display_resources()
75857585
];
75867586

75877587
$xApiPlugin = XApiPlugin::create();
7588-
75897588
if ($xApiPlugin->isEnabled()) {
75907589
$headers[] = Display::return_icon(
75917590
'import_scorm.png',
@@ -13171,9 +13170,7 @@ public function getFinalItemForm()
1317113170
$form->addHidden('action', 'add_final_item');
1317213171
$form->addHidden('path', Session::read('pathItem'));
1317313172
$form->addHidden('previous', $this->get_last());
13174-
$form->setDefaults(
13175-
['title' => $title, 'content_lp_certificate' => $content]
13176-
);
13173+
$form->setDefaults(['title' => $title, 'content_lp_certificate' => $content]);
1317713174

1317813175
if ($form->validate()) {
1317913176
$values = $form->exportValues();

0 commit comments

Comments
 (0)