Merge branch 'MOODLE_23_STABLE' into install_23_STABLE

blocks/rss_client/viewfeed.php

@@ -84,15 +84,16 @@
     $feedtitle =  $rss->get_title();
 }
 echo '<table align="center" width="50%" cellspacing="1">'."\n";
-echo '<tr><td colspan="2"><strong>'. $feedtitle .'</strong></td></tr>'."\n";
+echo '<tr><td colspan="2"><strong>'. s($feedtitle) .'</strong></td></tr>'."\n";
 foreach ($rss->get_items() as $item) {
     echo '<tr><td valign="middle">'."\n";
-    echo '<a href="'. $item->get_link() .'" target="_blank"><strong>'. $item->get_title();
+    echo '<a href="'.$item->get_link().'" target="_blank"><strong>';
+    echo s($item->get_title());
     echo '</strong></a>'."\n";
     echo '</td>'."\n";
     echo '</tr>'."\n";
     echo '<tr><td colspan="2"><small>';
-    echo $item->get_description() .'</small></td></tr>'."\n";
+    echo format_text($item->get_description(), FORMAT_HTML) .'</small></td></tr>'."\n";
 }
 echo '</table>'."\n";
 

blog/locallib.php

@@ -214,11 +214,14 @@ public function print_html($return=false) {
         $contentcell->text .= $template['body'];
         $contentcell->text .= $attachedimages;
 
-        // Uniquehash is used as a link to an external blog
         if (!empty($this->uniquehash)) {
-            $contentcell->text .= $OUTPUT->container_start('externalblog');
-            $contentcell->text .= html_writer::link($this->uniquehash, get_string('linktooriginalentry', 'blog'));
-            $contentcell->text .= $OUTPUT->container_end();
+            // Uniquehash is used as a link to an external blog
+            $url = clean_param($this->uniquehash, PARAM_URL);
+            if (!empty($url)) {
+                $contentcell->text .= $OUTPUT->container_start('externalblog');
+                $contentcell->text .= html_writer::link($url, get_string('linktooriginalentry', 'blog'));
+                $contentcell->text .= $OUTPUT->container_end();
+            }
         }
 
         // Links to tags

lib/simplepie/readme_moodle.txt

@@ -5,6 +5,8 @@ Obtained from http://github.com/simplepie/simplepie/commit/798f4674468316b8cc70f
 Changes:
   * None. This import contains _NO_CHANGES_ to the simplepie.inc file, changes are
     controlled through OO extension of the classes instead.
+  * Exception: The Sanitizer has been modified to return valid URLs. The change
+    is done through OO extension in 25 and upwards but not in 23 and 24.
 
 Dan Poltawski <talktodan@gmail.com>
 Petr Skoda

lib/simplepie/simplepie.class.php

@@ -14466,6 +14466,10 @@ public function sanitize($data, $type, $base = '')
 			if ($type & SIMPLEPIE_CONSTRUCT_IRI)
 			{
 				$data = SimplePie_Misc::absolutize_url($data, $base);
+				// Moodle modification - Only return valid URLs. Note this change is interim and
+				// 2.5 and upwards have the cleaning performed in our own sanitizer.
+				$data = clean_param($data, PARAM_URL);
+				// End of Moodle modification.
 			}
 
 			if ($type & (SIMPLEPIE_CONSTRUCT_TEXT | SIMPLEPIE_CONSTRUCT_IRI))

version.php

@@ -29,11 +29,11 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$version  = 2012062508.07;              // YYYYMMDD      = weekly release date of this DEV branch
+$version  = 2012062509.00;              // YYYYMMDD      = weekly release date of this DEV branch
                                         //         RR    = release increments - 00 in DEV branches
                                         //           .XX = incremental changes
 
-$release  = '2.3.8+ (Build: 20130905)';  // Human-friendly version name
+$release  = '2.3.9 (Build: 20130909)';  // Human-friendly version name
 
 $branch   = '23';                       // this version's branch
 $maturity = MATURITY_STABLE;            // this version's maturity level