5772 add encoding and decoding with saving and displaying opended fee…

…dback and remedial content
atutor · Mar 13, 2017 · 7db187c · 7db187c
1 parent cce297e
commit 7db187c
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 5 deletions.
diff --git a/include/lib/constants.inc.php b/include/lib/constants.inc.php
@@ -399,7 +399,7 @@
 
 $_field_formatting['themes.title']				= AT_FORMAT_NONE;
 
-$_field_formatting['tests_answers.answer']		= AT_FORMAT_NONE;
+$_field_formatting['tests_answers.answer']		= AT_FORMAT_QUOTES;
 $_field_formatting['tests_answers.notes']		= AT_FORMAT_ALL;
 //$_field_formatting['tests_questions.*']			= AT_FORMAT_SLASHES| AT_FORMAT_QUOTES;
 $_field_formatting['tests_questions.list']			= AT_FORMAT_SLASHES| AT_FORMAT_QUOTES;

diff --git a/mods/_standard/tests/create_question_long.php b/mods/_standard/tests/create_question_long.php
@@ -24,11 +24,11 @@
     header('Location: question_db.php');
     exit;
 } else if ($_POST['submit']) {
-    $_POST['feedback']          = trim($_POST['feedback']);
+    $_POST['feedback']          = htmlspecialchars(trim($_POST['feedback']), ENT_QUOTES);
     $_POST['question']          = htmlspecialchars(trim($_POST['question']), ENT_QUOTES);
     $_POST['category_id']       = intval($_POST['category_id']);
     $_POST['properties']        = intval($_POST['properties']);
-    $_POST['remedial_content']  = trim($_POST['remedial_content']);
+    $_POST['remedial_content']  = htmlspecialchars(trim($_POST['remedial_content']), ENT_QUOTES);
 
     if ($_POST['question'] == ''){
         $msg->addError(array('EMPTY_FIELDS', _AT('question')));

diff --git a/mods/_standard/tests/question_footer.php b/mods/_standard/tests/question_footer.php
@@ -17,13 +17,13 @@
 <div class="row">
     <label for="optional_feedback"><?php echo _AT('optional_feedback'); ?></label>
     <?php print_VE('optional_feedback'); ?>
-    <textarea id="optional_feedback" cols="50" rows="3" name="feedback" placeholder="<?php echo _AT('feedback_placeholder'); ?>"><?php echo htmlspecialchars($stripslashes($_POST['feedback'])); ?></textarea>
+    <textarea id="optional_feedback" cols="50" rows="3" name="feedback" placeholder="<?php echo _AT('feedback_placeholder'); ?>"><?php echo htmlspecialchars_decode($stripslashes($_POST['feedback']),ENT_QUOTES); ?></textarea>
 </div>
 
 <div class="row">
     <label for="remedial_content"><?php echo _AT('remedial_content'); ?></label>
     <?php print_VE('remedial_content'); ?>
-    <textarea id="remedial_content" cols="50" rows="6" name="remedial_content" placeholder="<?php echo _AT('remedial_content_placeholder'); ?>"><?php echo htmlspecialchars($stripslashes($_POST['remedial_content'])); ?></textarea>
+    <textarea id="remedial_content" cols="50" rows="6" name="remedial_content" placeholder="<?php echo _AT('remedial_content_placeholder'); ?>"><?php echo htmlspecialchars_decode($stripslashes($_POST['remedial_content']), ENT_QUOTES); ?></textarea>
 
 <div class="row buttons">
     <input type="submit" value="<?php echo _AT('save'); ?>"   name="submit" accesskey="s" />