Repository navigation
Escape feedback in hidden input of locked or overridden grades - #166
Merged
adrian-sarmas merged 1 commit intoOct 20, 2026
Conversation
adrian-sarmas
added a commit
that referenced
this pull request
Oct 20, 2026
The Atto editor, the default before Moodle 4.2, reads $PAGE->url when initialising, which triggered an unexpected debugging() call and failed the tests added in #166 on Moodle 4.0 and 4.1.
adrian-sarmas
merged commit Oct 20, 2026
9052b0a
into
elearningsoftware:master
44 of 54 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This issue was identified during a penetration test. When a grade is locked or overridden in the gradebook, the feedback was concatenated unescaped into the value attribute of a hidden input on the report page, allowing attribute injection; this change renders the input with html_writer::empty_tag() and adds unit tests.