Skip to content

Commit e561531

Browse files
committed
Gradebook: add remove_xss
1 parent 55bc1e3 commit e561531

File tree

4 files changed

+4
-4
lines changed

4 files changed

+4
-4
lines changed

main/gradebook/lib/fe/gradebooktable.class.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -423,7 +423,7 @@ public function get_table_data($from = 1, $per_page = null, $column = null, $dir
423423

424424
// Name.
425425
if ('Category' === get_class($item)) {
426-
$row[] = $invisibility_span_open.'<strong>'.$item->get_name().'</strong>'.$invisibility_span_close;
426+
$row[] = $invisibility_span_open.'<strong>'.Security::remove_XSS($item->get_name()).'</strong>'.$invisibility_span_close;
427427
$main_categories[$item->get_id()]['name'] = $item->get_name();
428428
} else {
429429
$name = $this->build_name_link($item, $type);

main/gradebook/lib/fe/linkaddeditform.class.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ public function __construct(
9292
$default_weight = $my_cat->get_weight();
9393
$select_gradebook->addOption(get_lang('Default'), $my_cat->get_id());
9494
} else {
95-
$select_gradebook->addOption($my_cat->get_name(), $my_cat->get_id());
95+
$select_gradebook->addOption(Security::remove_XSS($my_cat->get_name()), $my_cat->get_id());
9696
}
9797
} else {
9898
$select_gradebook->addOption(get_lang('Select'), 0);

main/gradebook/lib/flatview_data_generator.class.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,7 @@ public function get_header_names($items_start = 0, $items_count = null, $show_de
155155
$add_weight = " $sub_cat_weight %";
156156

157157
$mainHeader = Display::url(
158-
$sub_cat->get_name(),
158+
Security::remove_XSS($sub_cat->get_name()),
159159
api_get_self().'?selectcat='.$sub_cat->get_id().'&'.api_get_cidreq()
160160
).$add_weight;
161161

main/gradebook/lib/gradebook_data_generator.class.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ public function get_data(
124124
foreach ($visibleItems as $item) {
125125
$row = [];
126126
$row[] = $item;
127-
$row[] = $item->get_name();
127+
$row[] = Security::remove_XSS($item->get_name());
128128
// display the 2 first line of description and all description
129129
// on mouseover (https://support.chamilo.org/issues/6588)
130130
$row[] = '<span title="'.api_remove_tags_with_space($item->get_description()).'">'.

0 commit comments

Comments
 (0)