MDL-41820 XSS in the quiz responses report.

Thanks to Michael Hess for finding this bug and reporting it to us.

diff --git a/mod/quiz/report/responses/responses_table.php b/mod/quiz/report/responses/responses_table.php
index a5a0c09..3c9c7c9 100644 (file)
--- a/mod/quiz/report/responses/responses_table.php
+++ b/mod/quiz/report/responses/responses_table.php
@@ -97,6 +97,11 @@ class quiz_responses_table extends quiz_attempts_report_table {
             $summary = trim($stepdata->$field);
         }
 
+        if ($this->is_downloading() && $this->is_downloading() != 'xhtml') {
+            return $summary;
+        }
+        $summary = s($summary);
+
         if ($this->is_downloading() || $field != 'responsesummary') {
             return $summary;
         }