MDL-71009 question bank: escape idnumbers when displayed

moodle · Feb 26, 2021 · 9216860 · 9216860
1 parent 95dd305
commit 9216860
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 6 deletions.
diff --git a/question/classes/bank/question_name_idnumber_tags_column.php b/question/classes/bank/question_name_idnumber_tags_column.php
@@ -57,7 +57,7 @@ protected function display_content($question, $rowclasses) {
         if ($question->idnumber !== null && $question->idnumber !== '') {
             echo ' ' . \html_writer::span(
                             \html_writer::span(get_string('idnumber', 'question'), 'accesshide') . ' ' .
-                            \html_writer::span($question->idnumber, 'badge badge-primary'), 'ml-1');
+                            \html_writer::span(s($question->idnumber), 'badge badge-primary'), 'ml-1');
         }
 
         // Question tags.

diff --git a/question/tests/behat/sort_questions.feature b/question/tests/behat/sort_questions.feature
@@ -18,10 +18,10 @@ Feature: The questions in the question bank can be sorted in various ways
       | contextlevel | reference | name           |
       | Course       | C1        | Test questions |
     And the following "questions" exist:
-      | questioncategory | qtype     | name              | user     | questiontext    | idnumber  |
-      | Test questions   | essay     | A question 1 name | admin    | Question 1 text | numidnuma |
-      | Test questions   | essay     | B question 2 name | teacher1 | Question 2 text |           |
-      | Test questions   | numerical | C question 3 name | teacher1 | Question 3 text | numidnumc |
+      | questioncategory | qtype     | name              | user     | questiontext    | idnumber    |
+      | Test questions   | essay     | A question 1 name | admin    | Question 1 text | numidnum</a |
+      | Test questions   | essay     | B question 2 name | teacher1 | Question 2 text |             |
+      | Test questions   | numerical | C question 3 name | teacher1 | Question 3 text | numidnum</c |
     And I log in as "teacher1"
     And I am on "Course 1" course homepage
     And I navigate to "Question bank > Questions" in current page administration
@@ -34,7 +34,7 @@ Feature: The questions in the question bank can be sorted in various ways
   Scenario: The questions can be sorted by idnumber
     When I follow "Sort by ID number ascending"
     Then "C question 3 name" "checkbox" should appear after "A question 1 name" "checkbox"
-    And I should see "numidnumc" in the "C question 3 name" "table_row"
+    And I should see "numidnum</c" in the "C question 3 name" "table_row"
     And I follow "Sort by ID number descending"
     And "C question 3 name" "checkbox" should appear before "A question 1 name" "checkbox"