MDL-60233 mod_assign: Avoid HTML in the item field of external warnings

The item field is defined as PARAM_TEXT (no HTML tags allowed except
for multilang).
Using the s that add quotes to HTML characters we avoid potential Web
Services invalid parameters errors.

diff --git a/mod/assign/externallib.php b/mod/assign/externallib.php
index adb0a79..c4059c9 100644 (file)
--- a/mod/assign/externallib.php
+++ b/mod/assign/externallib.php
@@ -62,7 +62,7 @@ class mod_assign_external extends external_api {
             $message = 'Unknown warning type.';
         }
 
-        return array('item'=>$detail,
+        return array('item' => s($detail),
                      'itemid'=>$assignmentid,
                      'warningcode'=>$warningcode,
                      'message'=>$message);