MDL-31036 mod_assign: Don't strip quickgrading feedback of special chars

moodle · Jan 30, 2015 · 75d08f0 · 75d08f0
1 parent 4c27f52
commit 75d08f0
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 7 deletions.
diff --git a/mod/assign/feedback/comments/locallib.php b/mod/assign/feedback/comments/locallib.php
@@ -96,7 +96,7 @@ public function is_quickgrading_modified($userid, $grade) {
         }
         // Note that this handles the difference between empty and not in the quickgrading
         // form at all (hidden column).
-        $newvalue = optional_param('quickgrade_comments_' . $userid, false, PARAM_TEXT);
+        $newvalue = optional_param('quickgrade_comments_' . $userid, false, PARAM_RAW);
         return ($newvalue !== false) && ($newvalue != $commenttext);
     }
 
@@ -176,17 +176,16 @@ public function set_editor_text($name, $value, $gradeid) {
     public function save_quickgrading_changes($userid, $grade) {
         global $DB;
         $feedbackcomment = $this->get_feedback_comments($grade->id);
-        $feedbackpresent = optional_param('quickgrade_comments_' . $userid, false, PARAM_TEXT) !== false;
-        if (!$feedbackpresent) {
-            // Nothing to save (e.g. hidden column).
+        $quickgradecomments = optional_param('quickgrade_comments_' . $userid, null, PARAM_RAW);
+        if (!$quickgradecomments) {
             return true;
         }
         if ($feedbackcomment) {
-            $feedbackcomment->commenttext = optional_param('quickgrade_comments_' . $userid, '', PARAM_TEXT);
+            $feedbackcomment->commenttext = $quickgradecomments;
             return $DB->update_record('assignfeedback_comments', $feedbackcomment);
         } else {
             $feedbackcomment = new stdClass();
-            $feedbackcomment->commenttext = optional_param('quickgrade_comments_' . $userid, '', PARAM_TEXT);
+            $feedbackcomment->commenttext = $quickgradecomments;
             $feedbackcomment->commentformat = FORMAT_HTML;
             $feedbackcomment->grade = $grade->id;
             $feedbackcomment->assignment = $this->assignment->get_instance()->id;
@@ -485,7 +484,7 @@ public function is_empty(stdClass $grade) {
      * @return external_description|null
      */
     public function get_external_parameters() {
-        $editorparams = array('text' => new external_value(PARAM_TEXT, 'The text for this feedback.'),
+        $editorparams = array('text' => new external_value(PARAM_RAW, 'The text for this feedback.'),
                               'format' => new external_value(PARAM_INT, 'The format for this feedback'));
         $editorstructure = new external_single_structure($editorparams);
         return array('assignfeedbackcomments_editor' => $editorstructure);

diff --git a/mod/assign/upgrade.txt b/mod/assign/upgrade.txt
@@ -1,4 +1,7 @@
 This files describes API changes in the assign code.
+=== 2.9 ===
+* External parameter now returns PARAM_RAW instead of PARAM_TEXT for webservices using feedback comments.
+
 === 2.8 ===
 * Some DB changes were made to simplify the SQL required to query the latest attempt.
   - The assign_submission table now has a column "latest" which is set to 1 for the latest submission attempt.