Skip to content

Commit dd9bcd6

Browse files
committed
Security - Fix possible XSS attack vector using teacher role - reported by Javier Bloem
1 parent 94706d7 commit dd9bcd6

File tree

2 files changed

+6
-6
lines changed

2 files changed

+6
-6
lines changed

main/inc/lib/course.lib.php

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3372,7 +3372,7 @@ public static function display_special_courses($user_id, $load_dirs = false)
33723372
$course['status'] = STUDENT;
33733373
}
33743374

3375-
$params['icon'] = Display::return_icon('blackboard.png', $course_info['title'], array(), ICON_SIZE_LARGE);
3375+
$params['icon'] = Display::return_icon('blackboard.png', api_htmlentities($course_info['title']), array(), ICON_SIZE_LARGE);
33763376

33773377
$params['right_actions'] = '';
33783378
if (api_is_platform_admin()) {
@@ -3448,7 +3448,7 @@ public static function display_courses($user_id, $load_dirs = false)
34483448
while ($row = Database::fetch_array($result)) {
34493449
// We simply display the title of the category.
34503450
$params = array(
3451-
'icon' => Display::return_icon('folder_yellow.png', $row['title'], array(), ICON_SIZE_LARGE),
3451+
'icon' => Display::return_icon('folder_yellow.png', api_htmlentities($row['title']), array(), ICON_SIZE_LARGE),
34523452
'title' => $row['title'],
34533453
'class' => 'table_user_course_category'
34543454
);
@@ -3542,7 +3542,7 @@ public static function display_courses_in_category($user_category_id, $load_dirs
35423542
$show_notification = Display::show_notification($course_info);
35433543

35443544
// New code displaying the user's status in respect to this course.
3545-
$status_icon = Display::return_icon('blackboard.png', $course_info['title'], array(), ICON_SIZE_LARGE);
3545+
$status_icon = Display::return_icon('blackboard.png', api_htmlentities($course_info['title']), array(), ICON_SIZE_LARGE);
35463546

35473547
$params = array();
35483548
$params['right_actions'] = '';
@@ -3741,7 +3741,7 @@ public static function get_logged_user_course_html($course, $session_id = 0, $cl
37413741
}
37423742

37433743
$params = array();
3744-
$params['icon'] = Display::return_icon('blackboard_blue.png', $course_info['name'], array(), ICON_SIZE_LARGE);
3744+
$params['icon'] = Display::return_icon('blackboard_blue.png', api_htmlentities($course_info['name']), array(), ICON_SIZE_LARGE);
37453745
$params['link'] = $session_url;
37463746
$params['title'] = $session_title;
37473747

main/template/default/auth/courses_categories.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -251,10 +251,10 @@ function display_thumbnail($course, $icon_title)
251251
echo '<div class="thumbnail">';
252252
if (api_get_setting('show_courses_descriptions_in_catalog') == 'true') {
253253
echo '<a class="ajax" href="'.api_get_path(WEB_CODE_PATH).'inc/ajax/course_home.ajax.php?a=show_course_information&amp;code='.$course['code'].'" title="'.$icon_title.'" rel="gb_page_center[778]">';
254-
echo '<img src="'.$course_medium_image.'" alt="'.$title.'" />';
254+
echo '<img src="'.$course_medium_image.'" alt="'.api_htmlentities($title).'" />';
255255
echo '</a>';
256256
} else {
257-
echo '<img src="'.$course_medium_image.'" alt="'.$title.'"/>';
257+
echo '<img src="'.$course_medium_image.'" alt="'.api_htmlentities($title).'"/>';
258258
}
259259
echo '</div>'; // thumbail
260260
echo '</div>'; // span2

0 commit comments

Comments
 (0)