MDL-78971 quiz_grading: escape user identity fields on display.

moodle · Oct 4, 2023 · aa8ab48 · aa8ab48
1 parent b19a93b
commit aa8ab48
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/mod/quiz/report/grading/report.php b/mod/quiz/report/grading/report.php
@@ -720,13 +720,15 @@ protected function get_question_heading(stdClass $attempt, bool $shownames, bool
         $a = new stdClass();
         $a->attempt = $attempt->attempt;
         $a->fullname = fullname($attempt);
+
         $customfields = [];
         foreach ($this->extrauserfields as $field) {
-            if ($attempt->{s($field)}) {
-                $customfields[] = $attempt->{s($field)};
+            if (strval($attempt->{$field}) !== '') {
+                $customfields[] = s($attempt->{$field});
             }
         }
-        $a->customfields = trim(implode(', ', (array)$customfields), ' ,');
+
+        $a->customfields = implode(', ', $customfields);
 
         if ($shownames && $showcustomfields) {
             return get_string('gradingattemptwithcustomfields', 'quiz_grading', $a);