MDL-46223 Improve the marking guide output

moodle · Jul 8, 2014 · 666248c · 666248c
1 parent 1f8eb08
commit 666248c
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 17 deletions.
diff --git a/grade/grading/form/guide/guideeditor.php b/grade/grading/form/guide/guideeditor.php
@@ -100,6 +100,7 @@ public function toHtml() {
             $mode = gradingform_guide_controller::DISPLAY_EDIT_FULL;
             $module = array('name'=>'gradingform_guideeditor',
                 'fullpath'=>'/grade/grading/form/guide/js/guideeditor.js',
+                'requires' => array('base', 'dom', 'event', 'event-touch', 'escape'),
                 'strings' => array(
                     array('confirmdeletecriterion', 'gradingform_guide'),
                     array('clicktoedit', 'gradingform_guide'),

diff --git a/grade/grading/form/guide/js/guideeditor.js b/grade/grading/form/guide/js/guideeditor.js
@@ -111,9 +111,9 @@ M.gradingform_guideeditor.editmode = function(el, editmode) {
             value = M.str.gradingform_guide.clicktoedit
             taplain.addClass('empty')
         }
-        taplain.one('.textvalue').set('innerHTML', value)
+        taplain.one('.textvalue').set('innerHTML', Y.Escape.html(value))
         if (tb) {
-            tbplain.one('.textvalue').set('innerHTML', tb.get('value'))
+            tbplain.one('.textvalue').set('innerHTML', Y.Escape.html(tb.get('value')))
         }
         // hide/display textarea, textbox and plaintexts
         taplain.removeClass('hiddenelement')

diff --git a/grade/grading/form/guide/renderer.php b/grade/grading/form/guide/renderer.php
@@ -93,20 +93,20 @@ public function criterion_template($mode, $options, $elementname = '{NAME}', $cr
                 'name' => '{NAME}[criteria][{CRITERION-id}][sortorder]', 'value' => $criterion['sortorder']));
 
             $shortname = html_writer::empty_tag('input', array('type'=> 'text',
-                'name' => '{NAME}[criteria][{CRITERION-id}][shortname]',  'value' => htmlspecialchars($criterion['shortname']),
+                'name' => '{NAME}[criteria][{CRITERION-id}][shortname]',  'value' => $criterion['shortname'],
                 'id ' => '{NAME}[criteria][{CRITERION-id}][shortname]'));
             $shortname = html_writer::tag('div', $shortname, array('class'=>'criterionname'));
-            $description = html_writer::tag('textarea', htmlspecialchars($criterion['description']),
+            $description = html_writer::tag('textarea', s($criterion['description']),
                 array('name' => '{NAME}[criteria][{CRITERION-id}][description]', 'cols' => '65', 'rows' => '5'));
             $description = html_writer::tag('div', $description, array('class'=>'criteriondesc'));
 
-            $descriptionmarkers = html_writer::tag('textarea', htmlspecialchars($criterion['descriptionmarkers']),
+            $descriptionmarkers = html_writer::tag('textarea', s($criterion['descriptionmarkers']),
                 array('name' => '{NAME}[criteria][{CRITERION-id}][descriptionmarkers]', 'cols' => '65', 'rows' => '5'));
             $descriptionmarkers = html_writer::tag('div', $descriptionmarkers, array('class'=>'criteriondescmarkers'));
 
             $maxscore = html_writer::empty_tag('input', array('type'=> 'text',
                 'name' => '{NAME}[criteria][{CRITERION-id}][maxscore]', 'size' => '3',
-                'value' => htmlspecialchars($criterion['maxscore']),
+                'value' => $criterion['maxscore'],
                 'id' => '{NAME}[criteria][{CRITERION-id}][maxscore]'));
             $maxscore = html_writer::tag('div', $maxscore, array('class'=>'criterionmaxscore'));
         } else {
@@ -125,7 +125,7 @@ public function criterion_template($mode, $options, $elementname = '{NAME}', $cr
                        $mode == gradingform_guide_controller::DISPLAY_VIEW) {
                 $descriptionclass = 'descriptionreadonly';
             }
-            $shortname   = html_writer::tag('div', $criterion['shortname'],
+            $shortname   = html_writer::tag('div', s($criterion['shortname']),
                 array('class'=>'criterionshortname', 'name' => '{NAME}[criteria][{CRITERION-id}][shortname]'));
             $descmarkerclass = '';
             $descstudentclass = '';
@@ -137,13 +137,13 @@ public function criterion_template($mode, $options, $elementname = '{NAME}', $cr
                     $descstudentclass = ' hide';
                 }
             }
-            $description = html_writer::tag('div', $criterion['description'],
+            $description = html_writer::tag('div', s($criterion['description']),
                 array('class'=>'criteriondescription'.$descstudentclass,
                       'name' => '{NAME}[criteria][{CRITERION-id}][descriptionmarkers]'));
-            $descriptionmarkers   = html_writer::tag('div', $criterion['descriptionmarkers'],
+            $descriptionmarkers   = html_writer::tag('div', s($criterion['descriptionmarkers']),
                 array('class'=>'criteriondescriptionmarkers'.$descmarkerclass,
                       'name' => '{NAME}[criteria][{CRITERION-id}][descriptionmarkers]'));
-            $maxscore   = html_writer::tag('div', $criterion['maxscore'],
+            $maxscore   = html_writer::tag('div', s($criterion['maxscore']),
                 array('class'=>'criteriondescriptionscore', 'name' => '{NAME}[criteria][{CRITERION-id}][maxscore]'));
         }
 
@@ -193,7 +193,7 @@ public function criterion_template($mode, $options, $elementname = '{NAME}', $cr
                 $scoreclass = 'error';
                 $currentscore = $validationerrors[$criterion['id']]['score']; // Show invalid score in form.
             }
-            $input = html_writer::tag('textarea', htmlspecialchars($currentremark),
+            $input = html_writer::tag('textarea', s($currentremark),
                 array('name' => '{NAME}[criteria][{CRITERION-id}][remark]', 'cols' => '65', 'rows' => '5',
                       'class' => 'markingguideremark'));
             $criteriontemplate .= html_writer::tag('td', $input, array('class' => 'remark'));
@@ -202,7 +202,7 @@ public function criterion_template($mode, $options, $elementname = '{NAME}', $cr
             $score .= html_writer::empty_tag('input', array('type'=> 'text',
                 'name' => '{NAME}[criteria][{CRITERION-id}][score]', 'class' => $scoreclass,
                 'id' => '{NAME}[criteria][{CRITERION-id}][score]',
-                'size' => '3', 'value' => htmlspecialchars($currentscore)));
+                'size' => '3', 'value' => $currentscore));
             $score .= '/'.$maxscore;
 
             $criteriontemplate .= html_writer::tag('td', $score, array('class' => 'score'));
@@ -211,9 +211,9 @@ public function criterion_template($mode, $options, $elementname = '{NAME}', $cr
                 'name' => '{NAME}[criteria][{CRITERION-id}][remark]', 'value' => $currentremark));
         } else if ($mode == gradingform_guide_controller::DISPLAY_REVIEW ||
             $mode == gradingform_guide_controller::DISPLAY_VIEW) {
-            $criteriontemplate .= html_writer::tag('td', $currentremark, array('class' => 'remark'));
+            $criteriontemplate .= html_writer::tag('td', s($currentremark), array('class' => 'remark'));
             if (!empty($options['showmarkspercriterionstudents'])) {
-                $criteriontemplate .= html_writer::tag('td', htmlspecialchars($currentscore). ' / '.$maxscore,
+                $criteriontemplate .= html_writer::tag('td', s($currentscore). ' / '.$maxscore,
                     array('class' => 'score'));
             }
         }
@@ -272,7 +272,7 @@ public function comment_template($mode, $elementname = '{NAME}', $comment = null
             $criteriontemplate .= html_writer::end_tag('td'); // Controls.
             $criteriontemplate .= html_writer::empty_tag('input', array('type' => 'hidden',
                 'name' => '{NAME}[comments][{COMMENT-id}][sortorder]', 'value' => $comment['sortorder']));
-            $description = html_writer::tag('textarea', htmlspecialchars($comment['description']),
+            $description = html_writer::tag('textarea', s($comment['description']),
                 array('name' => '{NAME}[comments][{COMMENT-id}][description]', 'cols' => '65', 'rows' => '5'));
             $description = html_writer::tag('div', $description, array('class'=>'criteriondesc'));
         } else {
@@ -283,12 +283,12 @@ public function comment_template($mode, $elementname = '{NAME}', $comment = null
                     'name' => '{NAME}[comments][{COMMENT-id}][description]', 'value' => $comment['description']));
             }
             if ($mode == gradingform_guide_controller::DISPLAY_EVAL) {
-                $description = html_writer::tag('span', htmlspecialchars($comment['description']),
+                $description = html_writer::tag('span', s($comment['description']),
                     array('name' => '{NAME}[comments][{COMMENT-id}][description]',
                           'title' => get_string('clicktocopy', 'gradingform_guide'),
                           'id' => '{NAME}[comments][{COMMENT-id}]', 'class'=>'markingguidecomment'));
             } else {
-                $description = $comment['description'];
+                $description = s($comment['description']);
             }
         }
         $descriptionclass = 'description';