Merge branch 'MDL-67587-master-1' of git://github.com/mihailges/moodle
authorEloy Lafuente (stronk7) <stronk7@moodle.org>
Fri, 10 Apr 2020 10:09:55 +0000 (12:09 +0200)
committerEloy Lafuente (stronk7) <stronk7@moodle.org>
Fri, 10 Apr 2020 15:04:13 +0000 (17:04 +0200)
Changed PARAM_TEXT to PARAM_NOTAGS to "search" param
because it's the same but WITHOUT lang support and we
don't need lang support there.

Of course, both require to verify that the output is always
escaped. In this case (mustache) it is. Or also p() or s().

Without that XSS on form values are relatively easy!


Trivial merge